@shipfox/api-auth 10.0.0 → 10.2.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  type AuthEventMap,\n  authEventSchemas,\n} from '@shipfox/api-auth-dto';\nimport {administrationActionEventSchemas} from '@shipfox/api-common-dto';\nimport type {ShipfoxModule} from '@shipfox/node-module';\nimport {subscriberFactory} from '@shipfox/node-module';\nimport {config} from '#config.js';\nimport type {SignupPolicy} from '#core/ports.js';\nimport {createEnvironmentSignupPolicy} from '#core/signup-policy.js';\nimport {db} from '#db/db.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {authOutbox} from '#db/schema/outbox.js';\nimport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nimport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nimport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\nimport {createAuthE2eRoutes} from '#presentation/e2eRoutes/index.js';\nimport {createAuthInterModulePresentation} from '#presentation/inter-module.js';\nimport {\n  administrationRoutes,\n  administrationUserRoutes,\n} from '#presentation/routes/administration.js';\nimport {buildAuthRoutes} from '#presentation/routes/index.js';\nimport {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';\nimport {passwordLoginMethods} from './login-methods.js';\n\nconst authPublisherEventSchemas = {...authEventSchemas, ...administrationActionEventSchemas};\n\nexport type {AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nexport {\n  ADMIN_ROLES,\n  getCurrentAdminRole,\n  hasMinimumAdminRole,\n  highestAdminRole,\n  requireAdminRole,\n  revokeAdminGrant,\n} from '#core/admin-role.js';\nexport {\n  bootstrapFirstAdminOwner,\n  grantAdministratorRole,\n  revokeAdministratorGrant,\n} from '#core/administration.js';\nexport type {\n  CreateSessionForUserError,\n  CreateSessionForUserParams,\n  CreateSessionForUserResult,\n  ProvisionUserParams,\n} from '#core/auth.js';\nexport {createSessionForUser, provisionUser} from '#core/auth.js';\nexport type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';\nexport {findUserByEmail} from '#core/email-owner.js';\nexport type {AdminGrant} from '#core/entities/admin-grant.js';\nexport type {User, UserStatus} from '#core/entities/user.js';\nexport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  AdminRoleRequiredError,\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  InvalidAdminBootstrapTokenError,\n  InvalidCredentialsError,\n  LastAdminOwnerError,\n  SignupNotAllowedError,\n  UserNotFoundError,\n} from '#core/errors.js';\nexport {\n  issueJobLeaseToken,\n  jobLeaseParamsFrom,\n  verifyJobLeaseToken,\n} from '#core/job-lease-token.js';\nexport type {SignupPolicy} from '#core/ports.js';\nexport {\n  issueRunnerSessionToken,\n  verifyRunnerSessionToken,\n} from '#core/runner-session-token.js';\nexport {\n  createEnvironmentSignupPolicy,\n  DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,\n} from '#core/signup-policy.js';\nexport {\n  type AuthenticatedSessionContext,\n  createJwtAuthMethod,\n  getAuthenticatedSessionContext,\n  type RefreshSessionId,\n  type UserId,\n} from '#presentation/auth/jwt-auth.js';\nexport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nexport {\n  authCookiePlugin,\n  clearRefreshTokenCookie,\n  getRefreshTokenCookie,\n  setRefreshTokenCookie,\n} from '#presentation/auth/refresh-cookie.js';\nexport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\n\nconst subscriber = subscriberFactory<AuthEventMap>();\n\nexport interface CreateAuthModuleOptions {\n  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;\n  signupPolicy?: SignupPolicy;\n}\n\nexport function createAuthModule({\n  workspaces,\n  signupPolicy = createEnvironmentSignupPolicy(),\n}: CreateAuthModuleOptions): ShipfoxModule {\n  return {\n    name: 'auth',\n    database: {db, migrationsPath, databaseNamespace: 'auth'},\n    auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],\n    loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),\n    routes: [\n      buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces, signupPolicy),\n      administrationRoutes,\n      administrationUserRoutes,\n    ],\n    e2eRoutes: [createAuthE2eRoutes(workspaces)],\n    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authPublisherEventSchemas}],\n    subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],\n    interModulePresentations: [createAuthInterModulePresentation()],\n  };\n}\n"],"names":["AUTH_PASSWORD_RESET_SEND_REQUESTED","authEventSchemas","administrationActionEventSchemas","subscriberFactory","config","createEnvironmentSignupPolicy","db","migrationsPath","authOutbox","createJwtAuthMethod","createLeaseTokenAuthMethod","createRunnerSessionAuthMethod","createAuthE2eRoutes","createAuthInterModulePresentation","administrationRoutes","administrationUserRoutes","buildAuthRoutes","onPasswordResetSendRequested","passwordLoginMethods","authPublisherEventSchemas","ADMIN_ROLES","getCurrentAdminRole","hasMinimumAdminRole","highestAdminRole","requireAdminRole","revokeAdminGrant","bootstrapFirstAdminOwner","grantAdministratorRole","revokeAdministratorGrant","createSessionForUser","provisionUser","findUserByEmail","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","AdminRoleRequiredError","AuthDependencyUnavailableError","EmailNotVerifiedError","InvalidAdminBootstrapTokenError","InvalidCredentialsError","LastAdminOwnerError","SignupNotAllowedError","UserNotFoundError","issueJobLeaseToken","jobLeaseParamsFrom","verifyJobLeaseToken","issueRunnerSessionToken","verifyRunnerSessionToken","DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE","getAuthenticatedSessionContext","authCookiePlugin","clearRefreshTokenCookie","getRefreshTokenCookie","setRefreshTokenCookie","subscriber","createAuthModule","workspaces","signupPolicy","name","database","databaseNamespace","auth","loginMethods","AUTH_PASSWORD_ENABLED","routes","e2eRoutes","publishers","table","eventSchemas","subscribers","interModulePresentations"],"mappings":"AAAA,SACEA,kCAAkC,EAElCC,gBAAgB,QACX,wBAAwB;AAC/B,SAAQC,gCAAgC,QAAO,0BAA0B;AAEzE,SAAQC,iBAAiB,QAAO,uBAAuB;AACvD,SAAQC,MAAM,QAAO,aAAa;AAElC,SAAQC,6BAA6B,QAAO,yBAAyB;AACrE,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAAQC,UAAU,QAAO,uBAAuB;AAChD,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SAAQC,6BAA6B,QAAO,4CAA4C;AACxF,SAAQC,mBAAmB,QAAO,mCAAmC;AACrE,SAAQC,iCAAiC,QAAO,gCAAgC;AAChF,SACEC,oBAAoB,EACpBC,wBAAwB,QACnB,yCAAyC;AAChD,SAAQC,eAAe,QAAO,gCAAgC;AAC9D,SAAQC,4BAA4B,QAAO,qCAAqC;AAChF,SAAQC,oBAAoB,QAAO,qBAAqB;AAExD,MAAMC,4BAA4B;IAAC,GAAGlB,gBAAgB;IAAE,GAAGC,gCAAgC;AAAA;AAG3F,SACEkB,WAAW,EACXC,mBAAmB,EACnBC,mBAAmB,EACnBC,gBAAgB,EAChBC,gBAAgB,EAChBC,gBAAgB,QACX,sBAAsB;AAC7B,SACEC,wBAAwB,EACxBC,sBAAsB,EACtBC,wBAAwB,QACnB,0BAA0B;AAOjC,SAAQC,oBAAoB,EAAEC,aAAa,QAAO,gBAAgB;AAElE,SAAQC,eAAe,QAAO,uBAAuB;AAGrD,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,sBAAsB,EACtBC,8BAA8B,EAC9BC,qBAAqB,EACrBC,+BAA+B,EAC/BC,uBAAuB,EACvBC,mBAAmB,EACnBC,qBAAqB,EACrBC,iBAAiB,QACZ,kBAAkB;AACzB,SACEC,kBAAkB,EAClBC,kBAAkB,EAClBC,mBAAmB,QACd,2BAA2B;AAElC,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,gCAAgC;AACvC,SACE3C,6BAA6B,EAC7B4C,kCAAkC,QAC7B,yBAAyB;AAChC,SAEExC,mBAAmB,EACnByC,8BAA8B,QAGzB,iCAAiC;AACxC,SAAQxC,0BAA0B,QAAO,yCAAyC;AAClF,SACEyC,gBAAgB,EAChBC,uBAAuB,EACvBC,qBAAqB,EACrBC,qBAAqB,QAChB,uCAAuC;AAC9C,SAAQ3C,6BAA6B,QAAO,4CAA4C;AAExF,MAAM4C,aAAapD;AAOnB,OAAO,SAASqD,iBAAiB,EAC/BC,UAAU,EACVC,eAAerD,+BAA+B,EACtB;IACxB,OAAO;QACLsD,MAAM;QACNC,UAAU;YAACtD;YAAIC;YAAgBsD,mBAAmB;QAAM;QACxDC,MAAM;YAACrD;YAAuBC;YAA8BC;SAAgC;QAC5FoD,cAAc7C,qBAAqBd,OAAO4D,qBAAqB;QAC/DC,QAAQ;YACNjD,gBAAgBZ,OAAO4D,qBAAqB,EAAEP,YAAYC;YAC1D5C;YACAC;SACD;QACDmD,WAAW;YAACtD,oBAAoB6C;SAAY;QAC5CU,YAAY;YAAC;gBAACR,MAAM;gBAAQS,OAAO5D;gBAAYF;gBAAI+D,cAAclD;YAAyB;SAAE;QAC5FmD,aAAa;YAACf,WAAWvD,oCAAoCiB;SAA8B;QAC3FsD,0BAA0B;YAAC1D;SAAoC;IACjE;AACF"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  type AuthEventMap,\n  authEventSchemas,\n} from '@shipfox/api-auth-dto';\nimport {administrationActionEventSchemas} from '@shipfox/api-common-dto';\nimport type {ShipfoxModule} from '@shipfox/node-module';\nimport {subscriberFactory} from '@shipfox/node-module';\nimport {config} from '#config.js';\nimport type {SignupPolicy} from '#core/ports.js';\nimport {createEnvironmentSignupPolicy} from '#core/signup-policy.js';\nimport {db} from '#db/db.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {authOutbox} from '#db/schema/outbox.js';\nimport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nimport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nimport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\nimport {createAuthE2eRoutes} from '#presentation/e2eRoutes/index.js';\nimport {createAuthInterModulePresentation} from '#presentation/inter-module.js';\nimport {\n  administrationBootstrapRoutes,\n  administrationRoutes,\n  administrationUserRoutes,\n} from '#presentation/routes/administration.js';\nimport {buildAuthRoutes} from '#presentation/routes/index.js';\nimport {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';\nimport {passwordLoginMethods} from './login-methods.js';\n\nconst authPublisherEventSchemas = {...authEventSchemas, ...administrationActionEventSchemas};\n\nexport type {AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nexport {\n  ADMIN_ROLES,\n  getCurrentAdminRole,\n  hasMinimumAdminRole,\n  highestAdminRole,\n  requireAdminRole,\n  revokeAdminGrant,\n} from '#core/admin-role.js';\nexport {\n  bootstrapFirstAdminOwner,\n  grantAdministratorRole,\n  reactivateAdministratorUser,\n  revokeAdministratorGrant,\n  revokeAdministratorUserSessions,\n  suspendAdministratorUser,\n} from '#core/administration.js';\nexport type {\n  CreateSessionForUserError,\n  CreateSessionForUserParams,\n  CreateSessionForUserResult,\n  ProvisionUserParams,\n} from '#core/auth.js';\nexport {createSessionForUser, provisionUser} from '#core/auth.js';\nexport type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';\nexport {findUserByEmail} from '#core/email-owner.js';\nexport type {AdminGrant} from '#core/entities/admin-grant.js';\nexport type {User, UserStatus} from '#core/entities/user.js';\nexport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  AdminRoleRequiredError,\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  InvalidAdminBootstrapTokenError,\n  InvalidCredentialsError,\n  LastAdminOwnerError,\n  SignupNotAllowedError,\n  UserNotFoundError,\n} from '#core/errors.js';\nexport {\n  issueJobLeaseToken,\n  jobLeaseParamsFrom,\n  verifyJobLeaseToken,\n} from '#core/job-lease-token.js';\nexport type {SignupPolicy} from '#core/ports.js';\nexport {\n  issueRunnerSessionToken,\n  verifyRunnerSessionToken,\n} from '#core/runner-session-token.js';\nexport {\n  createEnvironmentSignupPolicy,\n  DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,\n} from '#core/signup-policy.js';\nexport {\n  type AuthenticatedSessionContext,\n  createJwtAuthMethod,\n  getAuthenticatedSessionContext,\n  type RefreshSessionId,\n  type UserId,\n} from '#presentation/auth/jwt-auth.js';\nexport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nexport {\n  authCookiePlugin,\n  clearRefreshTokenCookie,\n  getRefreshTokenCookie,\n  setRefreshTokenCookie,\n} from '#presentation/auth/refresh-cookie.js';\nexport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\n\nconst subscriber = subscriberFactory<AuthEventMap>();\n\nexport interface CreateAuthModuleOptions {\n  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;\n  signupPolicy?: SignupPolicy;\n}\n\nexport function createAuthModule({\n  workspaces,\n  signupPolicy = createEnvironmentSignupPolicy(),\n}: CreateAuthModuleOptions): ShipfoxModule {\n  return {\n    name: 'auth',\n    database: {db, migrationsPath, databaseNamespace: 'auth'},\n    auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],\n    loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),\n    routes: [\n      buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces, signupPolicy),\n      administrationBootstrapRoutes,\n      administrationRoutes,\n      administrationUserRoutes,\n    ],\n    e2eRoutes: [createAuthE2eRoutes(workspaces)],\n    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authPublisherEventSchemas}],\n    subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],\n    interModulePresentations: [createAuthInterModulePresentation()],\n  };\n}\n"],"names":["AUTH_PASSWORD_RESET_SEND_REQUESTED","authEventSchemas","administrationActionEventSchemas","subscriberFactory","config","createEnvironmentSignupPolicy","db","migrationsPath","authOutbox","createJwtAuthMethod","createLeaseTokenAuthMethod","createRunnerSessionAuthMethod","createAuthE2eRoutes","createAuthInterModulePresentation","administrationBootstrapRoutes","administrationRoutes","administrationUserRoutes","buildAuthRoutes","onPasswordResetSendRequested","passwordLoginMethods","authPublisherEventSchemas","ADMIN_ROLES","getCurrentAdminRole","hasMinimumAdminRole","highestAdminRole","requireAdminRole","revokeAdminGrant","bootstrapFirstAdminOwner","grantAdministratorRole","reactivateAdministratorUser","revokeAdministratorGrant","revokeAdministratorUserSessions","suspendAdministratorUser","createSessionForUser","provisionUser","findUserByEmail","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","AdminRoleRequiredError","AuthDependencyUnavailableError","EmailNotVerifiedError","InvalidAdminBootstrapTokenError","InvalidCredentialsError","LastAdminOwnerError","SignupNotAllowedError","UserNotFoundError","issueJobLeaseToken","jobLeaseParamsFrom","verifyJobLeaseToken","issueRunnerSessionToken","verifyRunnerSessionToken","DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE","getAuthenticatedSessionContext","authCookiePlugin","clearRefreshTokenCookie","getRefreshTokenCookie","setRefreshTokenCookie","subscriber","createAuthModule","workspaces","signupPolicy","name","database","databaseNamespace","auth","loginMethods","AUTH_PASSWORD_ENABLED","routes","e2eRoutes","publishers","table","eventSchemas","subscribers","interModulePresentations"],"mappings":"AAAA,SACEA,kCAAkC,EAElCC,gBAAgB,QACX,wBAAwB;AAC/B,SAAQC,gCAAgC,QAAO,0BAA0B;AAEzE,SAAQC,iBAAiB,QAAO,uBAAuB;AACvD,SAAQC,MAAM,QAAO,aAAa;AAElC,SAAQC,6BAA6B,QAAO,yBAAyB;AACrE,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAAQC,UAAU,QAAO,uBAAuB;AAChD,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SAAQC,6BAA6B,QAAO,4CAA4C;AACxF,SAAQC,mBAAmB,QAAO,mCAAmC;AACrE,SAAQC,iCAAiC,QAAO,gCAAgC;AAChF,SACEC,6BAA6B,EAC7BC,oBAAoB,EACpBC,wBAAwB,QACnB,yCAAyC;AAChD,SAAQC,eAAe,QAAO,gCAAgC;AAC9D,SAAQC,4BAA4B,QAAO,qCAAqC;AAChF,SAAQC,oBAAoB,QAAO,qBAAqB;AAExD,MAAMC,4BAA4B;IAAC,GAAGnB,gBAAgB;IAAE,GAAGC,gCAAgC;AAAA;AAG3F,SACEmB,WAAW,EACXC,mBAAmB,EACnBC,mBAAmB,EACnBC,gBAAgB,EAChBC,gBAAgB,EAChBC,gBAAgB,QACX,sBAAsB;AAC7B,SACEC,wBAAwB,EACxBC,sBAAsB,EACtBC,2BAA2B,EAC3BC,wBAAwB,EACxBC,+BAA+B,EAC/BC,wBAAwB,QACnB,0BAA0B;AAOjC,SAAQC,oBAAoB,EAAEC,aAAa,QAAO,gBAAgB;AAElE,SAAQC,eAAe,QAAO,uBAAuB;AAGrD,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,sBAAsB,EACtBC,8BAA8B,EAC9BC,qBAAqB,EACrBC,+BAA+B,EAC/BC,uBAAuB,EACvBC,mBAAmB,EACnBC,qBAAqB,EACrBC,iBAAiB,QACZ,kBAAkB;AACzB,SACEC,kBAAkB,EAClBC,kBAAkB,EAClBC,mBAAmB,QACd,2BAA2B;AAElC,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,gCAAgC;AACvC,SACE/C,6BAA6B,EAC7BgD,kCAAkC,QAC7B,yBAAyB;AAChC,SAEE5C,mBAAmB,EACnB6C,8BAA8B,QAGzB,iCAAiC;AACxC,SAAQ5C,0BAA0B,QAAO,yCAAyC;AAClF,SACE6C,gBAAgB,EAChBC,uBAAuB,EACvBC,qBAAqB,EACrBC,qBAAqB,QAChB,uCAAuC;AAC9C,SAAQ/C,6BAA6B,QAAO,4CAA4C;AAExF,MAAMgD,aAAaxD;AAOnB,OAAO,SAASyD,iBAAiB,EAC/BC,UAAU,EACVC,eAAezD,+BAA+B,EACtB;IACxB,OAAO;QACL0D,MAAM;QACNC,UAAU;YAAC1D;YAAIC;YAAgB0D,mBAAmB;QAAM;QACxDC,MAAM;YAACzD;YAAuBC;YAA8BC;SAAgC;QAC5FwD,cAAchD,qBAAqBf,OAAOgE,qBAAqB;QAC/DC,QAAQ;YACNpD,gBAAgBb,OAAOgE,qBAAqB,EAAEP,YAAYC;YAC1DhD;YACAC;YACAC;SACD;QACDsD,WAAW;YAAC1D,oBAAoBiD;SAAY;QAC5CU,YAAY;YAAC;gBAACR,MAAM;gBAAQS,OAAOhE;gBAAYF;gBAAImE,cAAcrD;YAAyB;SAAE;QAC5FsD,aAAa;YAACf,WAAW3D,oCAAoCkB;SAA8B;QAC3FyD,0BAA0B;YAAC9D;SAAoC;IACjE;AACF"}

package/dist/metrics/instance.d.ts

@@ -1,7 +1,7 @@
 export type AuthTokenType = 'session' | 'job_lease' | 'runner_session';
 export type AuthTokenVerificationOutcome = 'ok' | 'rejected';
 export type AuthTokenRefreshOutcome = 'rotated' | 'grace' | 'rejected';
-export type AuthRateLimitAction = 'login' | 'email-send' | 'bootstrap' | 'lookup';
+export type AuthRateLimitAction = 'login' | 'email-send' | 'bootstrap' | 'bootstrap-state' | 'lookup';
 export type AuthRateLimitScope = 'ip' | 'email';
 export type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';
 export declare function recordTokenIssued(tokenType: AuthTokenType): void;

package/dist/metrics/instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/metrics/instance.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,gBAAgB,CAAC;AACvE,MAAM,MAAM,4BAA4B,GAAG,IAAI,GAAG,UAAU,CAAC;AAC7D,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AACvE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,YAAY,GAAG,WAAW,GAAG,QAAQ,CAAC;AAClF,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,OAAO,CAAC;AAChD,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAsCzE,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAEhE;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,4BAA4B,GACpC,IAAI,CAEN;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAE3E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,GAAG,IAAI,CAQP;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD"}
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/metrics/instance.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,gBAAgB,CAAC;AACvE,MAAM,MAAM,4BAA4B,GAAG,IAAI,GAAG,UAAU,CAAC;AAC7D,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AACvE,MAAM,MAAM,mBAAmB,GAC3B,OAAO,GACP,YAAY,GACZ,WAAW,GACX,iBAAiB,GACjB,QAAQ,CAAC;AACb,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,OAAO,CAAC;AAChD,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAsCzE,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAEhE;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,4BAA4B,GACpC,IAAI,CAEN;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAE3E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,GAAG,IAAI,CAQP;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD"}

package/dist/metrics/instance.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/metrics/instance.ts"],"sourcesContent":["import {instanceMetrics} from '@shipfox/node-opentelemetry';\n\nexport type AuthTokenType = 'session' | 'job_lease' | 'runner_session';\nexport type AuthTokenVerificationOutcome = 'ok' | 'rejected';\nexport type AuthTokenRefreshOutcome = 'rotated' | 'grace' | 'rejected';\nexport type AuthRateLimitAction = 'login' | 'email-send' | 'bootstrap' | 'lookup';\nexport type AuthRateLimitScope = 'ip' | 'email';\nexport type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';\n\nconst meter = instanceMetrics.getMeter('auth');\n\nconst tokenIssuedCount = meter.createCounter<{token_type: AuthTokenType}>('auth_token_issued', {\n  description: 'Tokens issued by token type',\n});\n\nconst tokenVerifiedCount = meter.createCounter<{\n  token_type: AuthTokenType;\n  outcome: AuthTokenVerificationOutcome;\n}>('auth_token_verified', {description: 'Token verification attempts by token type and outcome'});\n\nconst tokenRefreshedCount = meter.createCounter<{outcome: AuthTokenRefreshOutcome}>(\n  'auth_token_refreshed',\n  {description: 'Refresh-token exchanges by outcome'},\n);\n\nconst rateLimitCheckCount = meter.createCounter<{\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}>('auth_rate_limit_checks', {\n  description: 'Authentication rate limit checks by action, scope, and outcome',\n});\n\nconst rateLimitPruneFailureCount = meter.createCounter('auth_rate_limit_prune_failures', {\n  description: 'Authentication rate limit prune failures',\n});\n\nfunction recordMetric(record: () => void): void {\n  try {\n    record();\n  } catch {\n    // Metrics must not affect authentication outcomes.\n  }\n}\n\nexport function recordTokenIssued(tokenType: AuthTokenType): void {\n  recordMetric(() => tokenIssuedCount.add(1, {token_type: tokenType}));\n}\n\nexport function recordTokenVerified(\n  tokenType: AuthTokenType,\n  outcome: AuthTokenVerificationOutcome,\n): void {\n  recordMetric(() => tokenVerifiedCount.add(1, {token_type: tokenType, outcome}));\n}\n\nexport function recordTokenRefreshed(outcome: AuthTokenRefreshOutcome): void {\n  recordMetric(() => tokenRefreshedCount.add(1, {outcome}));\n}\n\nexport function recordAuthRateLimitCheck(params: {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}): void {\n  recordMetric(() =>\n    rateLimitCheckCount.add(1, {\n      action: params.action,\n      scope: params.scope,\n      outcome: params.outcome,\n    }),\n  );\n}\n\nexport function recordAuthRateLimitPruneFailure(): void {\n  recordMetric(() => rateLimitPruneFailureCount.add(1));\n}\n"],"names":["instanceMetrics","meter","getMeter","tokenIssuedCount","createCounter","description","tokenVerifiedCount","tokenRefreshedCount","rateLimitCheckCount","rateLimitPruneFailureCount","recordMetric","record","recordTokenIssued","tokenType","add","token_type","recordTokenVerified","outcome","recordTokenRefreshed","recordAuthRateLimitCheck","params","action","scope","recordAuthRateLimitPruneFailure"],"mappings":"AAAA,SAAQA,eAAe,QAAO,8BAA8B;AAS5D,MAAMC,QAAQD,gBAAgBE,QAAQ,CAAC;AAEvC,MAAMC,mBAAmBF,MAAMG,aAAa,CAA8B,qBAAqB;IAC7FC,aAAa;AACf;AAEA,MAAMC,qBAAqBL,MAAMG,aAAa,CAG3C,uBAAuB;IAACC,aAAa;AAAuD;AAE/F,MAAME,sBAAsBN,MAAMG,aAAa,CAC7C,wBACA;IAACC,aAAa;AAAoC;AAGpD,MAAMG,sBAAsBP,MAAMG,aAAa,CAI5C,0BAA0B;IAC3BC,aAAa;AACf;AAEA,MAAMI,6BAA6BR,MAAMG,aAAa,CAAC,kCAAkC;IACvFC,aAAa;AACf;AAEA,SAASK,aAAaC,MAAkB;IACtC,IAAI;QACFA;IACF,EAAE,OAAM;IACN,mDAAmD;IACrD;AACF;AAEA,OAAO,SAASC,kBAAkBC,SAAwB;IACxDH,aAAa,IAAMP,iBAAiBW,GAAG,CAAC,GAAG;YAACC,YAAYF;QAAS;AACnE;AAEA,OAAO,SAASG,oBACdH,SAAwB,EACxBI,OAAqC;IAErCP,aAAa,IAAMJ,mBAAmBQ,GAAG,CAAC,GAAG;YAACC,YAAYF;YAAWI;QAAO;AAC9E;AAEA,OAAO,SAASC,qBAAqBD,OAAgC;IACnEP,aAAa,IAAMH,oBAAoBO,GAAG,CAAC,GAAG;YAACG;QAAO;AACxD;AAEA,OAAO,SAASE,yBAAyBC,MAIxC;IACCV,aAAa,IACXF,oBAAoBM,GAAG,CAAC,GAAG;YACzBO,QAAQD,OAAOC,MAAM;YACrBC,OAAOF,OAAOE,KAAK;YACnBL,SAASG,OAAOH,OAAO;QACzB;AAEJ;AAEA,OAAO,SAASM;IACdb,aAAa,IAAMD,2BAA2BK,GAAG,CAAC;AACpD"}
+{"version":3,"sources":["../../src/metrics/instance.ts"],"sourcesContent":["import {instanceMetrics} from '@shipfox/node-opentelemetry';\n\nexport type AuthTokenType = 'session' | 'job_lease' | 'runner_session';\nexport type AuthTokenVerificationOutcome = 'ok' | 'rejected';\nexport type AuthTokenRefreshOutcome = 'rotated' | 'grace' | 'rejected';\nexport type AuthRateLimitAction =\n  | 'login'\n  | 'email-send'\n  | 'bootstrap'\n  | 'bootstrap-state'\n  | 'lookup';\nexport type AuthRateLimitScope = 'ip' | 'email';\nexport type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';\n\nconst meter = instanceMetrics.getMeter('auth');\n\nconst tokenIssuedCount = meter.createCounter<{token_type: AuthTokenType}>('auth_token_issued', {\n  description: 'Tokens issued by token type',\n});\n\nconst tokenVerifiedCount = meter.createCounter<{\n  token_type: AuthTokenType;\n  outcome: AuthTokenVerificationOutcome;\n}>('auth_token_verified', {description: 'Token verification attempts by token type and outcome'});\n\nconst tokenRefreshedCount = meter.createCounter<{outcome: AuthTokenRefreshOutcome}>(\n  'auth_token_refreshed',\n  {description: 'Refresh-token exchanges by outcome'},\n);\n\nconst rateLimitCheckCount = meter.createCounter<{\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}>('auth_rate_limit_checks', {\n  description: 'Authentication rate limit checks by action, scope, and outcome',\n});\n\nconst rateLimitPruneFailureCount = meter.createCounter('auth_rate_limit_prune_failures', {\n  description: 'Authentication rate limit prune failures',\n});\n\nfunction recordMetric(record: () => void): void {\n  try {\n    record();\n  } catch {\n    // Metrics must not affect authentication outcomes.\n  }\n}\n\nexport function recordTokenIssued(tokenType: AuthTokenType): void {\n  recordMetric(() => tokenIssuedCount.add(1, {token_type: tokenType}));\n}\n\nexport function recordTokenVerified(\n  tokenType: AuthTokenType,\n  outcome: AuthTokenVerificationOutcome,\n): void {\n  recordMetric(() => tokenVerifiedCount.add(1, {token_type: tokenType, outcome}));\n}\n\nexport function recordTokenRefreshed(outcome: AuthTokenRefreshOutcome): void {\n  recordMetric(() => tokenRefreshedCount.add(1, {outcome}));\n}\n\nexport function recordAuthRateLimitCheck(params: {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}): void {\n  recordMetric(() =>\n    rateLimitCheckCount.add(1, {\n      action: params.action,\n      scope: params.scope,\n      outcome: params.outcome,\n    }),\n  );\n}\n\nexport function recordAuthRateLimitPruneFailure(): void {\n  recordMetric(() => rateLimitPruneFailureCount.add(1));\n}\n"],"names":["instanceMetrics","meter","getMeter","tokenIssuedCount","createCounter","description","tokenVerifiedCount","tokenRefreshedCount","rateLimitCheckCount","rateLimitPruneFailureCount","recordMetric","record","recordTokenIssued","tokenType","add","token_type","recordTokenVerified","outcome","recordTokenRefreshed","recordAuthRateLimitCheck","params","action","scope","recordAuthRateLimitPruneFailure"],"mappings":"AAAA,SAAQA,eAAe,QAAO,8BAA8B;AAc5D,MAAMC,QAAQD,gBAAgBE,QAAQ,CAAC;AAEvC,MAAMC,mBAAmBF,MAAMG,aAAa,CAA8B,qBAAqB;IAC7FC,aAAa;AACf;AAEA,MAAMC,qBAAqBL,MAAMG,aAAa,CAG3C,uBAAuB;IAACC,aAAa;AAAuD;AAE/F,MAAME,sBAAsBN,MAAMG,aAAa,CAC7C,wBACA;IAACC,aAAa;AAAoC;AAGpD,MAAMG,sBAAsBP,MAAMG,aAAa,CAI5C,0BAA0B;IAC3BC,aAAa;AACf;AAEA,MAAMI,6BAA6BR,MAAMG,aAAa,CAAC,kCAAkC;IACvFC,aAAa;AACf;AAEA,SAASK,aAAaC,MAAkB;IACtC,IAAI;QACFA;IACF,EAAE,OAAM;IACN,mDAAmD;IACrD;AACF;AAEA,OAAO,SAASC,kBAAkBC,SAAwB;IACxDH,aAAa,IAAMP,iBAAiBW,GAAG,CAAC,GAAG;YAACC,YAAYF;QAAS;AACnE;AAEA,OAAO,SAASG,oBACdH,SAAwB,EACxBI,OAAqC;IAErCP,aAAa,IAAMJ,mBAAmBQ,GAAG,CAAC,GAAG;YAACC,YAAYF;YAAWI;QAAO;AAC9E;AAEA,OAAO,SAASC,qBAAqBD,OAAgC;IACnEP,aAAa,IAAMH,oBAAoBO,GAAG,CAAC,GAAG;YAACG;QAAO;AACxD;AAEA,OAAO,SAASE,yBAAyBC,MAIxC;IACCV,aAAa,IACXF,oBAAoBM,GAAG,CAAC,GAAG;YACzBO,QAAQD,OAAOC,MAAM;YACrBC,OAAOF,OAAOE,KAAK;YACnBL,SAASG,OAAOH,OAAO;QACzB;AAEJ;AAEA,OAAO,SAASM;IACdb,aAAa,IAAMD,2BAA2BK,GAAG,CAAC;AACpD"}

package/dist/presentation/auth/bearer-token-auth.d.ts

@@ -7,6 +7,7 @@ interface UnauthorizedErrorParams {
 interface BearerTokenAuthMethodOptions<TClaims> {
     name: string;
     verifyToken: (token: string) => Promise<TClaims | null>;
+    isInvalidTokenError?: (error: unknown) => boolean;
     invalidTokenError: UnauthorizedErrorParams;
     setContext: (request: FastifyRequest, claims: TClaims) => void;
 }

package/dist/presentation/auth/bearer-token-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer-token-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/bearer-token-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,UAAU,EAAkC,MAAM,uBAAuB,CAAC;AACvF,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,SAAS,CAAC;AAE5C,UAAU,uBAAuB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,4BAA4B,CAAC,OAAO;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CAChE;AAOD,wBAAgB,2BAA2B,CAAC,OAAO,EACjD,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC,GAC7C,UAAU,CAaZ"}
+{"version":3,"file":"bearer-token-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/bearer-token-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,UAAU,EAAkC,MAAM,uBAAuB,CAAC;AACvF,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,SAAS,CAAC;AAE5C,UAAU,uBAAuB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,4BAA4B,CAAC,OAAO;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACxD,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAClD,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CAChE;AAOD,wBAAgB,2BAA2B,CAAC,OAAO,EACjD,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC,GAC7C,UAAU,CAiBZ"}

package/dist/presentation/auth/bearer-token-auth.js

@@ -9,16 +9,17 @@ export function createBearerTokenAuthMethod(options) {
         authenticate: async (request)=>{
             const token = extractBearerToken(request.headers.authorization);
             if (!token) throwUnauthorized(missingBearerError);
-            const claims = await verifyBearerToken(token, options.verifyToken);
+            const claims = await verifyBearerToken(token, options.verifyToken, options.isInvalidTokenError);
             if (!claims) throwUnauthorized(options.invalidTokenError);
             options.setContext(request, claims);
         }
     };
 }
-async function verifyBearerToken(token, verifyToken) {
+async function verifyBearerToken(token, verifyToken, isInvalidTokenError) {
     try {
         return await verifyToken(token);
-    } catch  {
+    } catch (error) {
+        if (isInvalidTokenError && !isInvalidTokenError(error)) throw error;
         return null;
     }
 }

package/dist/presentation/auth/bearer-token-auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/auth/bearer-token-auth.ts"],"sourcesContent":["import {type AuthMethod, ClientError, extractBearerToken} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\n\ninterface UnauthorizedErrorParams {\n  message: string;\n  code: string;\n}\n\ninterface BearerTokenAuthMethodOptions<TClaims> {\n  name: string;\n  verifyToken: (token: string) => Promise<TClaims | null>;\n  invalidTokenError: UnauthorizedErrorParams;\n  setContext: (request: FastifyRequest, claims: TClaims) => void;\n}\n\nconst missingBearerError: UnauthorizedErrorParams = {\n  message: 'Missing or invalid Authorization header',\n  code: 'unauthorized',\n};\n\nexport function createBearerTokenAuthMethod<TClaims>(\n  options: BearerTokenAuthMethodOptions<TClaims>,\n): AuthMethod {\n  return {\n    name: options.name,\n    authenticate: async (request) => {\n      const token = extractBearerToken(request.headers.authorization);\n      if (!token) throwUnauthorized(missingBearerError);\n\n      const claims = await verifyBearerToken(token, options.verifyToken);\n      if (!claims) throwUnauthorized(options.invalidTokenError);\n\n      options.setContext(request, claims);\n    },\n  };\n}\n\nasync function verifyBearerToken<TClaims>(\n  token: string,\n  verifyToken: (token: string) => Promise<TClaims | null>,\n): Promise<TClaims | null> {\n  try {\n    return await verifyToken(token);\n  } catch {\n    return null;\n  }\n}\n\nfunction throwUnauthorized(error: UnauthorizedErrorParams): never {\n  throw new ClientError(error.message, error.code, {status: 401});\n}\n"],"names":["ClientError","extractBearerToken","missingBearerError","message","code","createBearerTokenAuthMethod","options","name","authenticate","request","token","headers","authorization","throwUnauthorized","claims","verifyBearerToken","verifyToken","invalidTokenError","setContext","error","status"],"mappings":"AAAA,SAAyBA,WAAW,EAAEC,kBAAkB,QAAO,wBAAwB;AAevF,MAAMC,qBAA8C;IAClDC,SAAS;IACTC,MAAM;AACR;AAEA,OAAO,SAASC,4BACdC,OAA8C;IAE9C,OAAO;QACLC,MAAMD,QAAQC,IAAI;QAClBC,cAAc,OAAOC;YACnB,MAAMC,QAAQT,mBAAmBQ,QAAQE,OAAO,CAACC,aAAa;YAC9D,IAAI,CAACF,OAAOG,kBAAkBX;YAE9B,MAAMY,SAAS,MAAMC,kBAAkBL,OAAOJ,QAAQU,WAAW;YACjE,IAAI,CAACF,QAAQD,kBAAkBP,QAAQW,iBAAiB;YAExDX,QAAQY,UAAU,CAACT,SAASK;QAC9B;IACF;AACF;AAEA,eAAeC,kBACbL,KAAa,EACbM,WAAuD;IAEvD,IAAI;QACF,OAAO,MAAMA,YAAYN;IAC3B,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA,SAASG,kBAAkBM,KAA8B;IACvD,MAAM,IAAInB,YAAYmB,MAAMhB,OAAO,EAAEgB,MAAMf,IAAI,EAAE;QAACgB,QAAQ;IAAG;AAC/D"}
+{"version":3,"sources":["../../../src/presentation/auth/bearer-token-auth.ts"],"sourcesContent":["import {type AuthMethod, ClientError, extractBearerToken} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\n\ninterface UnauthorizedErrorParams {\n  message: string;\n  code: string;\n}\n\ninterface BearerTokenAuthMethodOptions<TClaims> {\n  name: string;\n  verifyToken: (token: string) => Promise<TClaims | null>;\n  isInvalidTokenError?: (error: unknown) => boolean;\n  invalidTokenError: UnauthorizedErrorParams;\n  setContext: (request: FastifyRequest, claims: TClaims) => void;\n}\n\nconst missingBearerError: UnauthorizedErrorParams = {\n  message: 'Missing or invalid Authorization header',\n  code: 'unauthorized',\n};\n\nexport function createBearerTokenAuthMethod<TClaims>(\n  options: BearerTokenAuthMethodOptions<TClaims>,\n): AuthMethod {\n  return {\n    name: options.name,\n    authenticate: async (request) => {\n      const token = extractBearerToken(request.headers.authorization);\n      if (!token) throwUnauthorized(missingBearerError);\n\n      const claims = await verifyBearerToken(\n        token,\n        options.verifyToken,\n        options.isInvalidTokenError,\n      );\n      if (!claims) throwUnauthorized(options.invalidTokenError);\n\n      options.setContext(request, claims);\n    },\n  };\n}\n\nasync function verifyBearerToken<TClaims>(\n  token: string,\n  verifyToken: (token: string) => Promise<TClaims | null>,\n  isInvalidTokenError: ((error: unknown) => boolean) | undefined,\n): Promise<TClaims | null> {\n  try {\n    return await verifyToken(token);\n  } catch (error) {\n    if (isInvalidTokenError && !isInvalidTokenError(error)) throw error;\n    return null;\n  }\n}\n\nfunction throwUnauthorized(error: UnauthorizedErrorParams): never {\n  throw new ClientError(error.message, error.code, {status: 401});\n}\n"],"names":["ClientError","extractBearerToken","missingBearerError","message","code","createBearerTokenAuthMethod","options","name","authenticate","request","token","headers","authorization","throwUnauthorized","claims","verifyBearerToken","verifyToken","isInvalidTokenError","invalidTokenError","setContext","error","status"],"mappings":"AAAA,SAAyBA,WAAW,EAAEC,kBAAkB,QAAO,wBAAwB;AAgBvF,MAAMC,qBAA8C;IAClDC,SAAS;IACTC,MAAM;AACR;AAEA,OAAO,SAASC,4BACdC,OAA8C;IAE9C,OAAO;QACLC,MAAMD,QAAQC,IAAI;QAClBC,cAAc,OAAOC;YACnB,MAAMC,QAAQT,mBAAmBQ,QAAQE,OAAO,CAACC,aAAa;YAC9D,IAAI,CAACF,OAAOG,kBAAkBX;YAE9B,MAAMY,SAAS,MAAMC,kBACnBL,OACAJ,QAAQU,WAAW,EACnBV,QAAQW,mBAAmB;YAE7B,IAAI,CAACH,QAAQD,kBAAkBP,QAAQY,iBAAiB;YAExDZ,QAAQa,UAAU,CAACV,SAASK;QAC9B;IACF;AACF;AAEA,eAAeC,kBACbL,KAAa,EACbM,WAAuD,EACvDC,mBAA8D;IAE9D,IAAI;QACF,OAAO,MAAMD,YAAYN;IAC3B,EAAE,OAAOU,OAAO;QACd,IAAIH,uBAAuB,CAACA,oBAAoBG,QAAQ,MAAMA;QAC9D,OAAO;IACT;AACF;AAEA,SAASP,kBAAkBO,KAA8B;IACvD,MAAM,IAAIpB,YAAYoB,MAAMjB,OAAO,EAAEiB,MAAMhB,IAAI,EAAE;QAACiB,QAAQ;IAAG;AAC/D"}

package/dist/presentation/auth/jwt-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/jwt-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAC,KAAK,UAAU,EAAc,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAQjD,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AAExC,MAAM,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;AAEzD,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,GAAG,IAAI,CAE9E;AAoBD;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,2BAA2B,CAAC,CAatC;AAED,wBAAgB,mBAAmB,IAAI,UAAU,CAgBhD"}
+{"version":3,"file":"jwt-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/jwt-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAC,KAAK,UAAU,EAAc,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AASjD,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AAExC,MAAM,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;AAEzD,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB;AASD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,GAAG,IAAI,CAE9E;AAoBD;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,2BAA2B,CAAC,CAatC;AAED,wBAAgB,mBAAmB,IAAI,UAAU,CAqChD"}

package/dist/presentation/auth/jwt-auth.js

@@ -3,8 +3,15 @@ import { userAccessTokenKey } from '@shipfox/node-auth-root-key';
 import { ClientError } from '@shipfox/node-fastify';
 import { verifyUserToken } from '#core/jwt.js';
 import { findActiveRefreshSession } from '#db/refresh-tokens.js';
+import { findUserById } from '#db/users.js';
 import { createBearerTokenAuthMethod } from './bearer-token-auth.js';
 const AUTHENTICATED_SESSION_CONTEXT_KEY = Symbol.for('@shipfox/api-auth/session');
+let InvalidJwtTokenError = class InvalidJwtTokenError extends Error {
+    constructor(){
+        super('Invalid JWT');
+        this.name = 'InvalidJwtTokenError';
+    }
+};
 export function getClientContext(request) {
     return getUserContext(request);
 }
@@ -41,10 +48,31 @@ function getAuthenticatedSessionTokenContext(request) {
 export function createJwtAuthMethod() {
     return createBearerTokenAuthMethod({
         name: AUTH_USER,
-        verifyToken: (token)=>verifyUserToken({
-                token,
-                secret: userAccessTokenKey()
-            }),
+        verifyToken: async (token)=>{
+            let claims;
+            try {
+                claims = await verifyUserToken({
+                    token,
+                    secret: userAccessTokenKey()
+                });
+            } catch  {
+                throw new InvalidJwtTokenError();
+            }
+            const user = await findUserById({
+                id: claims.sub
+            });
+            // Legacy access tokens without a session claim remain verifiable for the
+            // migration window; known suspended or deleted users are still rejected.
+            if (user && user.status !== 'active') return null;
+            if (!claims.refreshSessionId) return claims;
+            if (!user) return null;
+            const session = await findActiveRefreshSession({
+                sessionId: claims.refreshSessionId,
+                userId: claims.sub
+            });
+            return session ? claims : null;
+        },
+        isInvalidTokenError: (error)=>error instanceof InvalidJwtTokenError,
         invalidTokenError: {
             message: 'Invalid or expired token',
             code: 'unauthorized'

package/dist/presentation/auth/jwt-auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/auth/jwt-auth.ts"],"sourcesContent":["import {\n  AUTH_USER,\n  buildUserContext,\n  getUserContext,\n  setUserContext,\n  type UserContext,\n} from '@shipfox/api-auth-context';\nimport {userAccessTokenKey} from '@shipfox/node-auth-root-key';\nimport {type AuthMethod, ClientError} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\nimport type {RefreshToken} from '#core/entities/refresh-token.js';\nimport type {User} from '#core/entities/user.js';\nimport type {UserTokenClaims} from '#core/jwt.js';\nimport {verifyUserToken} from '#core/jwt.js';\nimport {findActiveRefreshSession} from '#db/refresh-tokens.js';\nimport {createBearerTokenAuthMethod} from './bearer-token-auth.js';\n\nconst AUTHENTICATED_SESSION_CONTEXT_KEY = Symbol.for('@shipfox/api-auth/session');\n\nexport type ClientContext = UserContext;\n\nexport type UserId = User['id'];\nexport type RefreshSessionId = RefreshToken['sessionId'];\n\nexport type AuthenticatedSessionContext = {\n  userId: UserId;\n  refreshSessionId: RefreshSessionId;\n};\n\nexport interface CreateJwtAuthMethodOptions {\n  secret: string;\n}\n\nexport function getClientContext(request: FastifyRequest): ClientContext | null {\n  return getUserContext(request);\n}\n\nfunction setAuthenticatedSessionContext(request: FastifyRequest, claims: UserTokenClaims): void {\n  (request as unknown as Record<symbol, unknown>)[AUTHENTICATED_SESSION_CONTEXT_KEY] = {\n    userId: claims.sub,\n    refreshSessionId: claims.refreshSessionId,\n  };\n}\n\nfunction getAuthenticatedSessionTokenContext(request: FastifyRequest): {\n  userId: UserId;\n  refreshSessionId: RefreshSessionId | undefined;\n} | null {\n  return (\n    ((request as unknown as Record<symbol, unknown>)[AUTHENTICATED_SESSION_CONTEXT_KEY] as\n      | {userId: UserId; refreshSessionId: RefreshSessionId | undefined}\n      | undefined) ?? null\n  );\n}\n\n/**\n * Resolves the active refresh session backing an authenticated user request.\n * The session check intentionally happens only for consumers that need browser-session binding.\n */\nexport async function getAuthenticatedSessionContext(\n  request: FastifyRequest,\n): Promise<AuthenticatedSessionContext> {\n  const client = getClientContext(request);\n  const token = getAuthenticatedSessionTokenContext(request);\n  if (!client || !token || token.userId !== client.userId || !token.refreshSessionId)\n    throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});\n\n  const session = await findActiveRefreshSession({\n    sessionId: token.refreshSessionId,\n    userId: client.userId,\n  });\n  if (!session) throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});\n\n  return {userId: client.userId, refreshSessionId: session.sessionId};\n}\n\nexport function createJwtAuthMethod(): AuthMethod {\n  return createBearerTokenAuthMethod({\n    name: AUTH_USER,\n    verifyToken: (token) => verifyUserToken({token, secret: userAccessTokenKey()}),\n    invalidTokenError: {message: 'Invalid or expired token', code: 'unauthorized'},\n    setContext: (request, claims) => {\n      const clientContext: ClientContext = buildUserContext({\n        userId: claims.sub,\n        email: claims.email,\n        name: claims.name ?? null,\n        memberships: claims.memberships,\n      });\n      setUserContext(request, clientContext);\n      setAuthenticatedSessionContext(request, claims);\n    },\n  });\n}\n"],"names":["AUTH_USER","buildUserContext","getUserContext","setUserContext","userAccessTokenKey","ClientError","verifyUserToken","findActiveRefreshSession","createBearerTokenAuthMethod","AUTHENTICATED_SESSION_CONTEXT_KEY","Symbol","for","getClientContext","request","setAuthenticatedSessionContext","claims","userId","sub","refreshSessionId","getAuthenticatedSessionTokenContext","getAuthenticatedSessionContext","client","token","status","session","sessionId","createJwtAuthMethod","name","verifyToken","secret","invalidTokenError","message","code","setContext","clientContext","email","memberships"],"mappings":"AAAA,SACEA,SAAS,EACTC,gBAAgB,EAChBC,cAAc,EACdC,cAAc,QAET,4BAA4B;AACnC,SAAQC,kBAAkB,QAAO,8BAA8B;AAC/D,SAAyBC,WAAW,QAAO,wBAAwB;AAKnE,SAAQC,eAAe,QAAO,eAAe;AAC7C,SAAQC,wBAAwB,QAAO,wBAAwB;AAC/D,SAAQC,2BAA2B,QAAO,yBAAyB;AAEnE,MAAMC,oCAAoCC,OAAOC,GAAG,CAAC;AAgBrD,OAAO,SAASC,iBAAiBC,OAAuB;IACtD,OAAOX,eAAeW;AACxB;AAEA,SAASC,+BAA+BD,OAAuB,EAAEE,MAAuB;IACrFF,OAA8C,CAACJ,kCAAkC,GAAG;QACnFO,QAAQD,OAAOE,GAAG;QAClBC,kBAAkBH,OAAOG,gBAAgB;IAC3C;AACF;AAEA,SAASC,oCAAoCN,OAAuB;IAIlE,OACE,AAAC,AAACA,OAA8C,CAACJ,kCAAkC,IAEjE;AAEtB;AAEA;;;CAGC,GACD,OAAO,eAAeW,+BACpBP,OAAuB;IAEvB,MAAMQ,SAAST,iBAAiBC;IAChC,MAAMS,QAAQH,oCAAoCN;IAClD,IAAI,CAACQ,UAAU,CAACC,SAASA,MAAMN,MAAM,KAAKK,OAAOL,MAAM,IAAI,CAACM,MAAMJ,gBAAgB,EAChF,MAAM,IAAIb,YAAY,4BAA4B,gBAAgB;QAACkB,QAAQ;IAAG;IAEhF,MAAMC,UAAU,MAAMjB,yBAAyB;QAC7CkB,WAAWH,MAAMJ,gBAAgB;QACjCF,QAAQK,OAAOL,MAAM;IACvB;IACA,IAAI,CAACQ,SAAS,MAAM,IAAInB,YAAY,4BAA4B,gBAAgB;QAACkB,QAAQ;IAAG;IAE5F,OAAO;QAACP,QAAQK,OAAOL,MAAM;QAAEE,kBAAkBM,QAAQC,SAAS;IAAA;AACpE;AAEA,OAAO,SAASC;IACd,OAAOlB,4BAA4B;QACjCmB,MAAM3B;QACN4B,aAAa,CAACN,QAAUhB,gBAAgB;gBAACgB;gBAAOO,QAAQzB;YAAoB;QAC5E0B,mBAAmB;YAACC,SAAS;YAA4BC,MAAM;QAAc;QAC7EC,YAAY,CAACpB,SAASE;YACpB,MAAMmB,gBAA+BjC,iBAAiB;gBACpDe,QAAQD,OAAOE,GAAG;gBAClBkB,OAAOpB,OAAOoB,KAAK;gBACnBR,MAAMZ,OAAOY,IAAI,IAAI;gBACrBS,aAAarB,OAAOqB,WAAW;YACjC;YACAjC,eAAeU,SAASqB;YACxBpB,+BAA+BD,SAASE;QAC1C;IACF;AACF"}
+{"version":3,"sources":["../../../src/presentation/auth/jwt-auth.ts"],"sourcesContent":["import {\n  AUTH_USER,\n  buildUserContext,\n  getUserContext,\n  setUserContext,\n  type UserContext,\n} from '@shipfox/api-auth-context';\nimport {userAccessTokenKey} from '@shipfox/node-auth-root-key';\nimport {type AuthMethod, ClientError} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\nimport type {RefreshToken} from '#core/entities/refresh-token.js';\nimport type {User} from '#core/entities/user.js';\nimport type {UserTokenClaims} from '#core/jwt.js';\nimport {verifyUserToken} from '#core/jwt.js';\nimport {findActiveRefreshSession} from '#db/refresh-tokens.js';\nimport {findUserById} from '#db/users.js';\nimport {createBearerTokenAuthMethod} from './bearer-token-auth.js';\n\nconst AUTHENTICATED_SESSION_CONTEXT_KEY = Symbol.for('@shipfox/api-auth/session');\n\nexport type ClientContext = UserContext;\n\nexport type UserId = User['id'];\nexport type RefreshSessionId = RefreshToken['sessionId'];\n\nexport type AuthenticatedSessionContext = {\n  userId: UserId;\n  refreshSessionId: RefreshSessionId;\n};\n\nexport interface CreateJwtAuthMethodOptions {\n  secret: string;\n}\n\nclass InvalidJwtTokenError extends Error {\n  constructor() {\n    super('Invalid JWT');\n    this.name = 'InvalidJwtTokenError';\n  }\n}\n\nexport function getClientContext(request: FastifyRequest): ClientContext | null {\n  return getUserContext(request);\n}\n\nfunction setAuthenticatedSessionContext(request: FastifyRequest, claims: UserTokenClaims): void {\n  (request as unknown as Record<symbol, unknown>)[AUTHENTICATED_SESSION_CONTEXT_KEY] = {\n    userId: claims.sub,\n    refreshSessionId: claims.refreshSessionId,\n  };\n}\n\nfunction getAuthenticatedSessionTokenContext(request: FastifyRequest): {\n  userId: UserId;\n  refreshSessionId: RefreshSessionId | undefined;\n} | null {\n  return (\n    ((request as unknown as Record<symbol, unknown>)[AUTHENTICATED_SESSION_CONTEXT_KEY] as\n      | {userId: UserId; refreshSessionId: RefreshSessionId | undefined}\n      | undefined) ?? null\n  );\n}\n\n/**\n * Resolves the active refresh session backing an authenticated user request.\n * The session check intentionally happens only for consumers that need browser-session binding.\n */\nexport async function getAuthenticatedSessionContext(\n  request: FastifyRequest,\n): Promise<AuthenticatedSessionContext> {\n  const client = getClientContext(request);\n  const token = getAuthenticatedSessionTokenContext(request);\n  if (!client || !token || token.userId !== client.userId || !token.refreshSessionId)\n    throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});\n\n  const session = await findActiveRefreshSession({\n    sessionId: token.refreshSessionId,\n    userId: client.userId,\n  });\n  if (!session) throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});\n\n  return {userId: client.userId, refreshSessionId: session.sessionId};\n}\n\nexport function createJwtAuthMethod(): AuthMethod {\n  return createBearerTokenAuthMethod({\n    name: AUTH_USER,\n    verifyToken: async (token) => {\n      let claims: UserTokenClaims;\n      try {\n        claims = await verifyUserToken({token, secret: userAccessTokenKey()});\n      } catch {\n        throw new InvalidJwtTokenError();\n      }\n      const user = await findUserById({id: claims.sub});\n\n      // Legacy access tokens without a session claim remain verifiable for the\n      // migration window; known suspended or deleted users are still rejected.\n      if (user && user.status !== 'active') return null;\n      if (!claims.refreshSessionId) return claims;\n      if (!user) return null;\n\n      const session = await findActiveRefreshSession({\n        sessionId: claims.refreshSessionId,\n        userId: claims.sub,\n      });\n      return session ? claims : null;\n    },\n    isInvalidTokenError: (error) => error instanceof InvalidJwtTokenError,\n    invalidTokenError: {message: 'Invalid or expired token', code: 'unauthorized'},\n    setContext: (request, claims) => {\n      const clientContext: ClientContext = buildUserContext({\n        userId: claims.sub,\n        email: claims.email,\n        name: claims.name ?? null,\n        memberships: claims.memberships,\n      });\n      setUserContext(request, clientContext);\n      setAuthenticatedSessionContext(request, claims);\n    },\n  });\n}\n"],"names":["AUTH_USER","buildUserContext","getUserContext","setUserContext","userAccessTokenKey","ClientError","verifyUserToken","findActiveRefreshSession","findUserById","createBearerTokenAuthMethod","AUTHENTICATED_SESSION_CONTEXT_KEY","Symbol","for","InvalidJwtTokenError","Error","name","getClientContext","request","setAuthenticatedSessionContext","claims","userId","sub","refreshSessionId","getAuthenticatedSessionTokenContext","getAuthenticatedSessionContext","client","token","status","session","sessionId","createJwtAuthMethod","verifyToken","secret","user","id","isInvalidTokenError","error","invalidTokenError","message","code","setContext","clientContext","email","memberships"],"mappings":"AAAA,SACEA,SAAS,EACTC,gBAAgB,EAChBC,cAAc,EACdC,cAAc,QAET,4BAA4B;AACnC,SAAQC,kBAAkB,QAAO,8BAA8B;AAC/D,SAAyBC,WAAW,QAAO,wBAAwB;AAKnE,SAAQC,eAAe,QAAO,eAAe;AAC7C,SAAQC,wBAAwB,QAAO,wBAAwB;AAC/D,SAAQC,YAAY,QAAO,eAAe;AAC1C,SAAQC,2BAA2B,QAAO,yBAAyB;AAEnE,MAAMC,oCAAoCC,OAAOC,GAAG,CAAC;AAgBrD,IAAA,AAAMC,uBAAN,MAAMA,6BAA6BC;IACjC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,SAASC,iBAAiBC,OAAuB;IACtD,OAAOf,eAAee;AACxB;AAEA,SAASC,+BAA+BD,OAAuB,EAAEE,MAAuB;IACrFF,OAA8C,CAACP,kCAAkC,GAAG;QACnFU,QAAQD,OAAOE,GAAG;QAClBC,kBAAkBH,OAAOG,gBAAgB;IAC3C;AACF;AAEA,SAASC,oCAAoCN,OAAuB;IAIlE,OACE,AAAC,AAACA,OAA8C,CAACP,kCAAkC,IAEjE;AAEtB;AAEA;;;CAGC,GACD,OAAO,eAAec,+BACpBP,OAAuB;IAEvB,MAAMQ,SAAST,iBAAiBC;IAChC,MAAMS,QAAQH,oCAAoCN;IAClD,IAAI,CAACQ,UAAU,CAACC,SAASA,MAAMN,MAAM,KAAKK,OAAOL,MAAM,IAAI,CAACM,MAAMJ,gBAAgB,EAChF,MAAM,IAAIjB,YAAY,4BAA4B,gBAAgB;QAACsB,QAAQ;IAAG;IAEhF,MAAMC,UAAU,MAAMrB,yBAAyB;QAC7CsB,WAAWH,MAAMJ,gBAAgB;QACjCF,QAAQK,OAAOL,MAAM;IACvB;IACA,IAAI,CAACQ,SAAS,MAAM,IAAIvB,YAAY,4BAA4B,gBAAgB;QAACsB,QAAQ;IAAG;IAE5F,OAAO;QAACP,QAAQK,OAAOL,MAAM;QAAEE,kBAAkBM,QAAQC,SAAS;IAAA;AACpE;AAEA,OAAO,SAASC;IACd,OAAOrB,4BAA4B;QACjCM,MAAMf;QACN+B,aAAa,OAAOL;YAClB,IAAIP;YACJ,IAAI;gBACFA,SAAS,MAAMb,gBAAgB;oBAACoB;oBAAOM,QAAQ5B;gBAAoB;YACrE,EAAE,OAAM;gBACN,MAAM,IAAIS;YACZ;YACA,MAAMoB,OAAO,MAAMzB,aAAa;gBAAC0B,IAAIf,OAAOE,GAAG;YAAA;YAE/C,yEAAyE;YACzE,yEAAyE;YACzE,IAAIY,QAAQA,KAAKN,MAAM,KAAK,UAAU,OAAO;YAC7C,IAAI,CAACR,OAAOG,gBAAgB,EAAE,OAAOH;YACrC,IAAI,CAACc,MAAM,OAAO;YAElB,MAAML,UAAU,MAAMrB,yBAAyB;gBAC7CsB,WAAWV,OAAOG,gBAAgB;gBAClCF,QAAQD,OAAOE,GAAG;YACpB;YACA,OAAOO,UAAUT,SAAS;QAC5B;QACAgB,qBAAqB,CAACC,QAAUA,iBAAiBvB;QACjDwB,mBAAmB;YAACC,SAAS;YAA4BC,MAAM;QAAc;QAC7EC,YAAY,CAACvB,SAASE;YACpB,MAAMsB,gBAA+BxC,iBAAiB;gBACpDmB,QAAQD,OAAOE,GAAG;gBAClBqB,OAAOvB,OAAOuB,KAAK;gBACnB3B,MAAMI,OAAOJ,IAAI,IAAI;gBACrB4B,aAAaxB,OAAOwB,WAAW;YACjC;YACAxC,eAAec,SAASwB;YACxBvB,+BAA+BD,SAASE;QAC1C;IACF;AACF"}

package/dist/presentation/routes/administration.d.ts

@@ -1,4 +1,5 @@
 import { type RouteGroup } from '@shipfox/node-fastify';
 export declare const administrationRoutes: RouteGroup;
+export declare const administrationBootstrapRoutes: RouteGroup;
 export declare const administrationUserRoutes: RouteGroup;
 //# sourceMappingURL=administration.d.ts.map

package/dist/presentation/routes/administration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"administration.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/administration.ts"],"names":[],"mappings":"AAcA,OAAO,EAA2B,KAAK,UAAU,EAAC,MAAM,uBAAuB,CAAC;AA2PhF,eAAO,MAAM,oBAAoB,EAAE,UAIlC,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,UAItC,CAAC"}
+{"version":3,"file":"administration.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/administration.ts"],"names":[],"mappings":"AAoBA,OAAO,EAA2B,KAAK,UAAU,EAAC,MAAM,uBAAuB,CAAC;AAwVhF,eAAO,MAAM,oBAAoB,EAAE,UAIlC,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,UAI3C,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,UAItC,CAAC"}

package/dist/presentation/routes/administration.js

@@ -1,10 +1,10 @@
 import { AUTH_USER } from '@shipfox/api-auth-context';
-import { administratorUserLookupQuerySchema, administratorUserSummarySchema, bootstrapAdminOwnerBodySchema, bootstrapAdminOwnerResponseSchema, grantAdminRoleBodySchema, grantAdminRoleResponseSchema, listAdminGrantsQuerySchema, listAdminGrantsResponseSchema, revokeAdminGrantBodySchema, revokeAdminGrantResponseSchema } from '@shipfox/api-auth-dto';
+import { adminBootstrapStateSchema, administratorUserLookupQuerySchema, administratorUserMutationResponseSchema, administratorUserSummarySchema, bootstrapAdminOwnerBodySchema, bootstrapAdminOwnerResponseSchema, grantAdminRoleBodySchema, grantAdminRoleResponseSchema, listAdminGrantsQuerySchema, listAdminGrantsResponseSchema, reactivateAdministratorUserBodySchema, revokeAdminGrantBodySchema, revokeAdminGrantResponseSchema, revokeAdministratorUserSessionsBodySchema, revokeAdministratorUserSessionsResponseSchema, suspendAdministratorUserBodySchema } from '@shipfox/api-auth-dto';
 import { decodeTimestampIdCursor, encodeTimestampIdCursor } from '@shipfox/node-drizzle';
 import { ClientError, defineRoute } from '@shipfox/node-fastify';
 import { z } from 'zod';
 import { requireAdminRole } from '#core/admin-role.js';
-import { bootstrapFirstAdminOwner, findAdministratorUserSummary, grantAdministratorRole, listAdministratorGrantSummaries, revokeAdministratorGrant } from '#core/administration.js';
+import { bootstrapFirstAdminOwner, findAdministratorUserSummary, getAdminBootstrapState, grantAdministratorRole, listAdministratorGrantSummaries, reactivateAdministratorUser, revokeAdministratorGrant, revokeAdministratorUserSessions, suspendAdministratorUser } from '#core/administration.js';
 import { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, AdminRoleRequiredError, InvalidAdminBootstrapTokenError, LastAdminOwnerError, UserNotFoundError } from '#core/errors.js';
 import { getClientContext } from '#presentation/auth/jwt-auth.js';
 import { createAuthIpRateLimitPreHandler } from './rate-limit.js';
@@ -64,6 +64,12 @@ function toAdministratorGrantSummaryDto(grant) {
         user: grant.user
     };
 }
+function toAdministratorUserMutationDto(result) {
+    return {
+        ...toAdministratorUserSummaryDto(result.user),
+        correlation_id: result.correlationId
+    };
+}
 function translateAdministrationError(error) {
     if (error instanceof AdminRoleRequiredError) {
         throw new ClientError('Administrator role required', 'forbidden', {
@@ -134,6 +140,21 @@ const bootstrapRoute = defineRoute({
         return toAdminGrantDto(grant);
     }
 });
+const bootstrapStateRoute = defineRoute({
+    method: 'GET',
+    path: '/bootstrap-state',
+    description: 'Read whether first administrator owner bootstrap is available.',
+    schema: {
+        response: {
+            200: adminBootstrapStateSchema
+        }
+    },
+    preHandler: createAuthIpRateLimitPreHandler('bootstrap-state'),
+    errorHandler: translateAdministrationError,
+    handler: async ()=>({
+            state: await getAdminBootstrapState()
+        })
+});
 const listRoute = defineRoute({
     method: 'GET',
     path: '/',
@@ -196,6 +217,88 @@ const userLookupRoute = defineRoute({
         return toAdministratorUserSummaryDto(user);
     }
 });
+const suspendUserRoute = defineRoute({
+    method: 'POST',
+    path: '/:userId/suspend',
+    description: 'Suspend a user and revoke all of its active sessions.',
+    schema: {
+        params: z.object({
+            userId: z.string().uuid()
+        }),
+        body: suspendAdministratorUserBodySchema,
+        response: {
+            200: administratorUserMutationResponseSchema
+        }
+    },
+    errorHandler: translateAdministrationError,
+    handler: async (request)=>{
+        const result = await suspendAdministratorUser({
+            actorId: requireActorId(request),
+            userId: request.params.userId,
+            reason: request.body.reason,
+            idempotencyKey: requireIdempotencyKey(request),
+            correlationId: request.id
+        });
+        return toAdministratorUserMutationDto(result);
+    }
+});
+const reactivateUserRoute = defineRoute({
+    method: 'POST',
+    path: '/:userId/reactivate',
+    description: 'Reactivate a suspended user without restoring revoked sessions.',
+    schema: {
+        params: z.object({
+            userId: z.string().uuid()
+        }),
+        body: reactivateAdministratorUserBodySchema,
+        response: {
+            200: administratorUserMutationResponseSchema
+        }
+    },
+    errorHandler: translateAdministrationError,
+    handler: async (request)=>{
+        const result = await reactivateAdministratorUser({
+            actorId: requireActorId(request),
+            userId: request.params.userId,
+            ...request.body.reason ? {
+                reason: request.body.reason
+            } : {},
+            idempotencyKey: requireIdempotencyKey(request),
+            correlationId: request.id
+        });
+        return toAdministratorUserMutationDto(result);
+    }
+});
+const revokeUserSessionsRoute = defineRoute({
+    method: 'POST',
+    path: '/:userId/revoke-sessions',
+    description: 'Revoke all active sessions for a user without changing account status.',
+    schema: {
+        params: z.object({
+            userId: z.string().uuid()
+        }),
+        body: revokeAdministratorUserSessionsBodySchema,
+        response: {
+            200: revokeAdministratorUserSessionsResponseSchema
+        }
+    },
+    errorHandler: translateAdministrationError,
+    handler: async (request)=>{
+        const result = await revokeAdministratorUserSessions({
+            actorId: requireActorId(request),
+            userId: request.params.userId,
+            ...request.body.reason ? {
+                reason: request.body.reason
+            } : {},
+            idempotencyKey: requireIdempotencyKey(request),
+            correlationId: request.id
+        });
+        return {
+            ...toAdministratorUserMutationDto(result),
+            sessions_revoked: result.sessionsRevoked
+        };
+    }
+});
 const grantRoute = defineRoute({
     method: 'POST',
     path: '/',
@@ -256,11 +359,21 @@ export const administrationRoutes = {
         revokeRoute
     ]
 };
+export const administrationBootstrapRoutes = {
+    prefix: '/admin/auth',
+    auth: AUTH_USER,
+    routes: [
+        bootstrapStateRoute
+    ]
+};
 export const administrationUserRoutes = {
     prefix: '/admin/auth/users',
     auth: AUTH_USER,
     routes: [
-        userLookupRoute
+        userLookupRoute,
+        suspendUserRoute,
+        reactivateUserRoute,
+        revokeUserSessionsRoute
     ]
 };
 

package/dist/presentation/routes/administration.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/administration.ts"],"sourcesContent":["import {AUTH_USER} from '@shipfox/api-auth-context';\nimport {\n  administratorUserLookupQuerySchema,\n  administratorUserSummarySchema,\n  bootstrapAdminOwnerBodySchema,\n  bootstrapAdminOwnerResponseSchema,\n  grantAdminRoleBodySchema,\n  grantAdminRoleResponseSchema,\n  listAdminGrantsQuerySchema,\n  listAdminGrantsResponseSchema,\n  revokeAdminGrantBodySchema,\n  revokeAdminGrantResponseSchema,\n} from '@shipfox/api-auth-dto';\nimport {decodeTimestampIdCursor, encodeTimestampIdCursor} from '@shipfox/node-drizzle';\nimport {ClientError, defineRoute, type RouteGroup} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\nimport {z} from 'zod';\nimport {requireAdminRole} from '#core/admin-role.js';\nimport {\n  bootstrapFirstAdminOwner,\n  findAdministratorUserSummary,\n  grantAdministratorRole,\n  listAdministratorGrantSummaries,\n  revokeAdministratorGrant,\n} from '#core/administration.js';\nimport type {AdminGrant} from '#core/entities/admin-grant.js';\nimport type {\n  AdministratorGrantSummary,\n  AdministratorUserSummary,\n} from '#core/entities/administrator-read-model.js';\nimport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  AdminRoleRequiredError,\n  InvalidAdminBootstrapTokenError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n} from '#core/errors.js';\nimport {getClientContext} from '#presentation/auth/jwt-auth.js';\nimport {createAuthIpRateLimitPreHandler} from './rate-limit.js';\n\nconst idempotencyKeyMaxLength = 256;\n\nfunction requireActorId(request: FastifyRequest): string {\n  const client = getClientContext(request);\n  if (!client) {\n    throw new ClientError('Authentication required', 'unauthorized', {status: 401});\n  }\n  return client.userId;\n}\n\nfunction requireIdempotencyKey(request: FastifyRequest): string {\n  const value = request.headers['idempotency-key'];\n  const key = Array.isArray(value) ? value[0] : value;\n  if (!key || key.trim().length === 0 || key.length > idempotencyKeyMaxLength) {\n    throw new ClientError('Idempotency-Key header is required', 'idempotency-key-required', {\n      status: 400,\n    });\n  }\n  return key;\n}\n\nasync function requireAdministratorObserver(request: FastifyRequest): Promise<void> {\n  await requireAdminRole({userId: requireActorId(request), minimumRole: 'admin-observer'});\n}\n\nfunction toAdminGrantDto(grant: AdminGrant) {\n  return {\n    id: grant.id,\n    user_id: grant.userId,\n    role: grant.role,\n    revoked_at: grant.revokedAt?.toISOString() ?? null,\n    created_at: grant.createdAt.toISOString(),\n    updated_at: grant.updatedAt.toISOString(),\n  };\n}\n\nfunction toAdministratorUserSummaryDto(user: AdministratorUserSummary) {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    status: user.status,\n    email_verified_at: user.emailVerifiedAt?.toISOString() ?? null,\n    created_at: user.createdAt.toISOString(),\n    admin_role: user.adminRole,\n  };\n}\n\nfunction toAdministratorGrantSummaryDto(grant: AdministratorGrantSummary) {\n  return {\n    grant_id: grant.grantId,\n    role: grant.role,\n    created_at: grant.createdAt.toISOString(),\n    revoked_at: grant.revokedAt?.toISOString() ?? null,\n    user: grant.user,\n  };\n}\n\nfunction translateAdministrationError(error: unknown): never {\n  if (error instanceof AdminRoleRequiredError) {\n    throw new ClientError('Administrator role required', 'forbidden', {\n      status: 403,\n      details: {required_role: error.minimumRole},\n    });\n  }\n  if (error instanceof InvalidAdminBootstrapTokenError) {\n    throw new ClientError('Bootstrap token is invalid', 'bootstrap-token-invalid', {\n      status: 403,\n    });\n  }\n  if (error instanceof AdminBootstrapClosedError) {\n    throw new ClientError('First administrator owner already exists', 'bootstrap-closed', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminGrantAlreadyExistsError) {\n    throw new ClientError('Administrator grant already exists', 'grant-already-exists', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminGrantNotFoundError) {\n    throw new ClientError('Administrator grant not found', 'not-found', {status: 404});\n  }\n  if (error instanceof UserNotFoundError) {\n    throw new ClientError('User not found', 'not-found', {status: 404});\n  }\n  if (error instanceof LastAdminOwnerError) {\n    throw new ClientError('Cannot remove the final active administrator owner', 'last-owner', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminIdempotencyKeyReuseError) {\n    throw new ClientError(\n      'Idempotency-Key was already used for a different command',\n      'idempotency-key-reused',\n      {status: 409},\n    );\n  }\n  throw error;\n}\n\nconst bootstrapRoute = defineRoute({\n  method: 'POST',\n  path: '/bootstrap',\n  description: 'Claim the first administrator owner role with the deployment bootstrap token.',\n  schema: {\n    body: bootstrapAdminOwnerBodySchema,\n    response: {201: bootstrapAdminOwnerResponseSchema},\n  },\n  preHandler: createAuthIpRateLimitPreHandler('bootstrap'),\n  errorHandler: translateAdministrationError,\n  handler: async (request, reply) => {\n    const actorId = requireActorId(request);\n    const grant = await bootstrapFirstAdminOwner({\n      actorId,\n      bootstrapToken: request.body.bootstrap_token,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    reply.code(201);\n    return toAdminGrantDto(grant);\n  },\n});\n\nconst listRoute = defineRoute({\n  method: 'GET',\n  path: '/',\n  description: 'List bounded local administrator grant summaries.',\n  schema: {\n    querystring: listAdminGrantsQuerySchema,\n    response: {200: listAdminGrantsResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const {limit, cursor} = request.query;\n    const decodedCursor = decodeTimestampIdCursor(cursor);\n    if (cursor && !decodedCursor) {\n      throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});\n    }\n\n    const result = await listAdministratorGrantSummaries({\n      actorId: requireActorId(request),\n      limit,\n      ...(decodedCursor ? {cursor: decodedCursor} : {}),\n    });\n    return {\n      grants: result.grants.map(toAdministratorGrantSummaryDto),\n      next_cursor: result.nextCursor ? encodeTimestampIdCursor(result.nextCursor) : null,\n    };\n  },\n});\n\nconst userLookupRoute = defineRoute({\n  method: 'GET',\n  path: '/',\n  description: 'Find one administrator-safe user summary by exact ID or email.',\n  schema: {\n    querystring: administratorUserLookupQuerySchema,\n    response: {200: administratorUserSummarySchema},\n  },\n  preHandler: [requireAdministratorObserver, createAuthIpRateLimitPreHandler('lookup')],\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const {id, user_id: userId, email} = request.query;\n    const lookupId = id ?? userId;\n    const actorId = requireActorId(request);\n    const user = lookupId\n      ? await findAdministratorUserSummary({actorId, id: lookupId})\n      : email\n        ? await findAdministratorUserSummary({actorId, email})\n        : undefined;\n    if (!user) throw new UserNotFoundError(lookupId ?? email ?? 'unknown');\n    return toAdministratorUserSummaryDto(user);\n  },\n});\n\nconst grantRoute = defineRoute({\n  method: 'POST',\n  path: '/',\n  description: 'Grant a local administrator role to an active user.',\n  schema: {\n    body: grantAdminRoleBodySchema,\n    response: {201: grantAdminRoleResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request, reply) => {\n    const actorId = requireActorId(request);\n    const grant = await grantAdministratorRole({\n      actorId,\n      userId: request.body.user_id,\n      role: request.body.role,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    reply.code(201);\n    return toAdminGrantDto(grant);\n  },\n});\n\nconst revokeRoute = defineRoute({\n  method: 'DELETE',\n  path: '/:grantId',\n  description: 'Revoke a local administrator grant.',\n  schema: {\n    params: z.object({grantId: z.string().uuid()}),\n    body: revokeAdminGrantBodySchema,\n    response: {200: revokeAdminGrantResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const grant = await revokeAdministratorGrant({\n      actorId: requireActorId(request),\n      grantId: request.params.grantId,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return toAdminGrantDto(grant);\n  },\n});\n\nexport const administrationRoutes: RouteGroup = {\n  prefix: '/admin/auth/admin-grants',\n  auth: AUTH_USER,\n  routes: [bootstrapRoute, listRoute, grantRoute, revokeRoute],\n};\n\nexport const administrationUserRoutes: RouteGroup = {\n  prefix: '/admin/auth/users',\n  auth: AUTH_USER,\n  routes: [userLookupRoute],\n};\n"],"names":["AUTH_USER","administratorUserLookupQuerySchema","administratorUserSummarySchema","bootstrapAdminOwnerBodySchema","bootstrapAdminOwnerResponseSchema","grantAdminRoleBodySchema","grantAdminRoleResponseSchema","listAdminGrantsQuerySchema","listAdminGrantsResponseSchema","revokeAdminGrantBodySchema","revokeAdminGrantResponseSchema","decodeTimestampIdCursor","encodeTimestampIdCursor","ClientError","defineRoute","z","requireAdminRole","bootstrapFirstAdminOwner","findAdministratorUserSummary","grantAdministratorRole","listAdministratorGrantSummaries","revokeAdministratorGrant","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","AdminRoleRequiredError","InvalidAdminBootstrapTokenError","LastAdminOwnerError","UserNotFoundError","getClientContext","createAuthIpRateLimitPreHandler","idempotencyKeyMaxLength","requireActorId","request","client","status","userId","requireIdempotencyKey","value","headers","key","Array","isArray","trim","length","requireAdministratorObserver","minimumRole","toAdminGrantDto","grant","id","user_id","role","revoked_at","revokedAt","toISOString","created_at","createdAt","updated_at","updatedAt","toAdministratorUserSummaryDto","user","email","name","email_verified_at","emailVerifiedAt","admin_role","adminRole","toAdministratorGrantSummaryDto","grant_id","grantId","translateAdministrationError","error","details","required_role","bootstrapRoute","method","path","description","schema","body","response","preHandler","errorHandler","handler","reply","actorId","bootstrapToken","bootstrap_token","idempotencyKey","correlationId","code","listRoute","querystring","limit","cursor","query","decodedCursor","result","grants","map","next_cursor","nextCursor","userLookupRoute","lookupId","undefined","grantRoute","reason","revokeRoute","params","object","string","uuid","administrationRoutes","prefix","auth","routes","administrationUserRoutes"],"mappings":"AAAA,SAAQA,SAAS,QAAO,4BAA4B;AACpD,SACEC,kCAAkC,EAClCC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,iCAAiC,EACjCC,wBAAwB,EACxBC,4BAA4B,EAC5BC,0BAA0B,EAC1BC,6BAA6B,EAC7BC,0BAA0B,EAC1BC,8BAA8B,QACzB,wBAAwB;AAC/B,SAAQC,uBAAuB,EAAEC,uBAAuB,QAAO,wBAAwB;AACvF,SAAQC,WAAW,EAAEC,WAAW,QAAwB,wBAAwB;AAEhF,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,gBAAgB,QAAO,sBAAsB;AACrD,SACEC,wBAAwB,EACxBC,4BAA4B,EAC5BC,sBAAsB,EACtBC,+BAA+B,EAC/BC,wBAAwB,QACnB,0BAA0B;AAMjC,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,sBAAsB,EACtBC,+BAA+B,EAC/BC,mBAAmB,EACnBC,iBAAiB,QACZ,kBAAkB;AACzB,SAAQC,gBAAgB,QAAO,iCAAiC;AAChE,SAAQC,+BAA+B,QAAO,kBAAkB;AAEhE,MAAMC,0BAA0B;AAEhC,SAASC,eAAeC,OAAuB;IAC7C,MAAMC,SAASL,iBAAiBI;IAChC,IAAI,CAACC,QAAQ;QACX,MAAM,IAAItB,YAAY,2BAA2B,gBAAgB;YAACuB,QAAQ;QAAG;IAC/E;IACA,OAAOD,OAAOE,MAAM;AACtB;AAEA,SAASC,sBAAsBJ,OAAuB;IACpD,MAAMK,QAAQL,QAAQM,OAAO,CAAC,kBAAkB;IAChD,MAAMC,MAAMC,MAAMC,OAAO,CAACJ,SAASA,KAAK,CAAC,EAAE,GAAGA;IAC9C,IAAI,CAACE,OAAOA,IAAIG,IAAI,GAAGC,MAAM,KAAK,KAAKJ,IAAII,MAAM,GAAGb,yBAAyB;QAC3E,MAAM,IAAInB,YAAY,sCAAsC,4BAA4B;YACtFuB,QAAQ;QACV;IACF;IACA,OAAOK;AACT;AAEA,eAAeK,6BAA6BZ,OAAuB;IACjE,MAAMlB,iBAAiB;QAACqB,QAAQJ,eAAeC;QAAUa,aAAa;IAAgB;AACxF;AAEA,SAASC,gBAAgBC,KAAiB;IACxC,OAAO;QACLC,IAAID,MAAMC,EAAE;QACZC,SAASF,MAAMZ,MAAM;QACrBe,MAAMH,MAAMG,IAAI;QAChBC,YAAYJ,MAAMK,SAAS,EAAEC,iBAAiB;QAC9CC,YAAYP,MAAMQ,SAAS,CAACF,WAAW;QACvCG,YAAYT,MAAMU,SAAS,CAACJ,WAAW;IACzC;AACF;AAEA,SAASK,8BAA8BC,IAA8B;IACnE,OAAO;QACLX,IAAIW,KAAKX,EAAE;QACXY,OAAOD,KAAKC,KAAK;QACjBC,MAAMF,KAAKE,IAAI;QACf3B,QAAQyB,KAAKzB,MAAM;QACnB4B,mBAAmBH,KAAKI,eAAe,EAAEV,iBAAiB;QAC1DC,YAAYK,KAAKJ,SAAS,CAACF,WAAW;QACtCW,YAAYL,KAAKM,SAAS;IAC5B;AACF;AAEA,SAASC,+BAA+BnB,KAAgC;IACtE,OAAO;QACLoB,UAAUpB,MAAMqB,OAAO;QACvBlB,MAAMH,MAAMG,IAAI;QAChBI,YAAYP,MAAMQ,SAAS,CAACF,WAAW;QACvCF,YAAYJ,MAAMK,SAAS,EAAEC,iBAAiB;QAC9CM,MAAMZ,MAAMY,IAAI;IAClB;AACF;AAEA,SAASU,6BAA6BC,KAAc;IAClD,IAAIA,iBAAiB9C,wBAAwB;QAC3C,MAAM,IAAIb,YAAY,+BAA+B,aAAa;YAChEuB,QAAQ;YACRqC,SAAS;gBAACC,eAAeF,MAAMzB,WAAW;YAAA;QAC5C;IACF;IACA,IAAIyB,iBAAiB7C,iCAAiC;QACpD,MAAM,IAAId,YAAY,8BAA8B,2BAA2B;YAC7EuB,QAAQ;QACV;IACF;IACA,IAAIoC,iBAAiBlD,2BAA2B;QAC9C,MAAM,IAAIT,YAAY,4CAA4C,oBAAoB;YACpFuB,QAAQ;QACV;IACF;IACA,IAAIoC,iBAAiBjD,8BAA8B;QACjD,MAAM,IAAIV,YAAY,sCAAsC,wBAAwB;YAClFuB,QAAQ;QACV;IACF;IACA,IAAIoC,iBAAiBhD,yBAAyB;QAC5C,MAAM,IAAIX,YAAY,iCAAiC,aAAa;YAACuB,QAAQ;QAAG;IAClF;IACA,IAAIoC,iBAAiB3C,mBAAmB;QACtC,MAAM,IAAIhB,YAAY,kBAAkB,aAAa;YAACuB,QAAQ;QAAG;IACnE;IACA,IAAIoC,iBAAiB5C,qBAAqB;QACxC,MAAM,IAAIf,YAAY,sDAAsD,cAAc;YACxFuB,QAAQ;QACV;IACF;IACA,IAAIoC,iBAAiB/C,+BAA+B;QAClD,MAAM,IAAIZ,YACR,4DACA,0BACA;YAACuB,QAAQ;QAAG;IAEhB;IACA,MAAMoC;AACR;AAEA,MAAMG,iBAAiB7D,YAAY;IACjC8D,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAM7E;QACN8E,UAAU;YAAC,KAAK7E;QAAiC;IACnD;IACA8E,YAAYnD,gCAAgC;IAC5CoD,cAAcZ;IACda,SAAS,OAAOlD,SAASmD;QACvB,MAAMC,UAAUrD,eAAeC;QAC/B,MAAMe,QAAQ,MAAMhC,yBAAyB;YAC3CqE;YACAC,gBAAgBrD,QAAQ8C,IAAI,CAACQ,eAAe;YAC5CC,gBAAgBnD,sBAAsBJ;YACtCwD,eAAexD,QAAQgB,EAAE;QAC3B;QACAmC,MAAMM,IAAI,CAAC;QACX,OAAO3C,gBAAgBC;IACzB;AACF;AAEA,MAAM2C,YAAY9E,YAAY;IAC5B8D,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNc,aAAatF;QACb0E,UAAU;YAAC,KAAKzE;QAA6B;IAC/C;IACA2E,cAAcZ;IACda,SAAS,OAAOlD;QACd,MAAM,EAAC4D,KAAK,EAAEC,MAAM,EAAC,GAAG7D,QAAQ8D,KAAK;QACrC,MAAMC,gBAAgBtF,wBAAwBoF;QAC9C,IAAIA,UAAU,CAACE,eAAe;YAC5B,MAAM,IAAIpF,YAAY,kBAAkB,kBAAkB;gBAACuB,QAAQ;YAAG;QACxE;QAEA,MAAM8D,SAAS,MAAM9E,gCAAgC;YACnDkE,SAASrD,eAAeC;YACxB4D;YACA,GAAIG,gBAAgB;gBAACF,QAAQE;YAAa,IAAI,CAAC,CAAC;QAClD;QACA,OAAO;YACLE,QAAQD,OAAOC,MAAM,CAACC,GAAG,CAAChC;YAC1BiC,aAAaH,OAAOI,UAAU,GAAG1F,wBAAwBsF,OAAOI,UAAU,IAAI;QAChF;IACF;AACF;AAEA,MAAMC,kBAAkBzF,YAAY;IAClC8D,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNc,aAAa5F;QACbgF,UAAU;YAAC,KAAK/E;QAA8B;IAChD;IACAgF,YAAY;QAACpC;QAA8Bf,gCAAgC;KAAU;IACrFoD,cAAcZ;IACda,SAAS,OAAOlD;QACd,MAAM,EAACgB,EAAE,EAAEC,SAASd,MAAM,EAAEyB,KAAK,EAAC,GAAG5B,QAAQ8D,KAAK;QAClD,MAAMQ,WAAWtD,MAAMb;QACvB,MAAMiD,UAAUrD,eAAeC;QAC/B,MAAM2B,OAAO2C,WACT,MAAMtF,6BAA6B;YAACoE;YAASpC,IAAIsD;QAAQ,KACzD1C,QACE,MAAM5C,6BAA6B;YAACoE;YAASxB;QAAK,KAClD2C;QACN,IAAI,CAAC5C,MAAM,MAAM,IAAIhC,kBAAkB2E,YAAY1C,SAAS;QAC5D,OAAOF,8BAA8BC;IACvC;AACF;AAEA,MAAM6C,aAAa5F,YAAY;IAC7B8D,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAM3E;QACN4E,UAAU;YAAC,KAAK3E;QAA4B;IAC9C;IACA6E,cAAcZ;IACda,SAAS,OAAOlD,SAASmD;QACvB,MAAMC,UAAUrD,eAAeC;QAC/B,MAAMe,QAAQ,MAAM9B,uBAAuB;YACzCmE;YACAjD,QAAQH,QAAQ8C,IAAI,CAAC7B,OAAO;YAC5BC,MAAMlB,QAAQ8C,IAAI,CAAC5B,IAAI;YACvBuD,QAAQzE,QAAQ8C,IAAI,CAAC2B,MAAM;YAC3BlB,gBAAgBnD,sBAAsBJ;YACtCwD,eAAexD,QAAQgB,EAAE;QAC3B;QACAmC,MAAMM,IAAI,CAAC;QACX,OAAO3C,gBAAgBC;IACzB;AACF;AAEA,MAAM2D,cAAc9F,YAAY;IAC9B8D,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACN8B,QAAQ9F,EAAE+F,MAAM,CAAC;YAACxC,SAASvD,EAAEgG,MAAM,GAAGC,IAAI;QAAE;QAC5ChC,MAAMvE;QACNwE,UAAU;YAAC,KAAKvE;QAA8B;IAChD;IACAyE,cAAcZ;IACda,SAAS,OAAOlD;QACd,MAAMe,QAAQ,MAAM5B,yBAAyB;YAC3CiE,SAASrD,eAAeC;YACxBoC,SAASpC,QAAQ2E,MAAM,CAACvC,OAAO;YAC/BqC,QAAQzE,QAAQ8C,IAAI,CAAC2B,MAAM;YAC3BlB,gBAAgBnD,sBAAsBJ;YACtCwD,eAAexD,QAAQgB,EAAE;QAC3B;QACA,OAAOF,gBAAgBC;IACzB;AACF;AAEA,OAAO,MAAMgE,uBAAmC;IAC9CC,QAAQ;IACRC,MAAMnH;IACNoH,QAAQ;QAACzC;QAAgBiB;QAAWc;QAAYE;KAAY;AAC9D,EAAE;AAEF,OAAO,MAAMS,2BAAuC;IAClDH,QAAQ;IACRC,MAAMnH;IACNoH,QAAQ;QAACb;KAAgB;AAC3B,EAAE"}
+{"version":3,"sources":["../../../src/presentation/routes/administration.ts"],"sourcesContent":["import {AUTH_USER} from '@shipfox/api-auth-context';\nimport {\n  adminBootstrapStateSchema,\n  administratorUserLookupQuerySchema,\n  administratorUserMutationResponseSchema,\n  administratorUserSummarySchema,\n  bootstrapAdminOwnerBodySchema,\n  bootstrapAdminOwnerResponseSchema,\n  grantAdminRoleBodySchema,\n  grantAdminRoleResponseSchema,\n  listAdminGrantsQuerySchema,\n  listAdminGrantsResponseSchema,\n  reactivateAdministratorUserBodySchema,\n  revokeAdminGrantBodySchema,\n  revokeAdminGrantResponseSchema,\n  revokeAdministratorUserSessionsBodySchema,\n  revokeAdministratorUserSessionsResponseSchema,\n  suspendAdministratorUserBodySchema,\n} from '@shipfox/api-auth-dto';\nimport {decodeTimestampIdCursor, encodeTimestampIdCursor} from '@shipfox/node-drizzle';\nimport {ClientError, defineRoute, type RouteGroup} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\nimport {z} from 'zod';\nimport {requireAdminRole} from '#core/admin-role.js';\nimport {\n  bootstrapFirstAdminOwner,\n  findAdministratorUserSummary,\n  getAdminBootstrapState,\n  grantAdministratorRole,\n  listAdministratorGrantSummaries,\n  reactivateAdministratorUser,\n  revokeAdministratorGrant,\n  revokeAdministratorUserSessions,\n  suspendAdministratorUser,\n} from '#core/administration.js';\nimport type {AdminGrant} from '#core/entities/admin-grant.js';\nimport type {\n  AdministratorGrantSummary,\n  AdministratorUserSummary,\n} from '#core/entities/administrator-read-model.js';\nimport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  AdminRoleRequiredError,\n  InvalidAdminBootstrapTokenError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n} from '#core/errors.js';\nimport {getClientContext} from '#presentation/auth/jwt-auth.js';\nimport {createAuthIpRateLimitPreHandler} from './rate-limit.js';\n\nconst idempotencyKeyMaxLength = 256;\n\nfunction requireActorId(request: FastifyRequest): string {\n  const client = getClientContext(request);\n  if (!client) {\n    throw new ClientError('Authentication required', 'unauthorized', {status: 401});\n  }\n  return client.userId;\n}\n\nfunction requireIdempotencyKey(request: FastifyRequest): string {\n  const value = request.headers['idempotency-key'];\n  const key = Array.isArray(value) ? value[0] : value;\n  if (!key || key.trim().length === 0 || key.length > idempotencyKeyMaxLength) {\n    throw new ClientError('Idempotency-Key header is required', 'idempotency-key-required', {\n      status: 400,\n    });\n  }\n  return key;\n}\n\nasync function requireAdministratorObserver(request: FastifyRequest): Promise<void> {\n  await requireAdminRole({userId: requireActorId(request), minimumRole: 'admin-observer'});\n}\n\nfunction toAdminGrantDto(grant: AdminGrant) {\n  return {\n    id: grant.id,\n    user_id: grant.userId,\n    role: grant.role,\n    revoked_at: grant.revokedAt?.toISOString() ?? null,\n    created_at: grant.createdAt.toISOString(),\n    updated_at: grant.updatedAt.toISOString(),\n  };\n}\n\nfunction toAdministratorUserSummaryDto(user: AdministratorUserSummary) {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    status: user.status,\n    email_verified_at: user.emailVerifiedAt?.toISOString() ?? null,\n    created_at: user.createdAt.toISOString(),\n    admin_role: user.adminRole,\n  };\n}\n\nfunction toAdministratorGrantSummaryDto(grant: AdministratorGrantSummary) {\n  return {\n    grant_id: grant.grantId,\n    role: grant.role,\n    created_at: grant.createdAt.toISOString(),\n    revoked_at: grant.revokedAt?.toISOString() ?? null,\n    user: grant.user,\n  };\n}\n\nfunction toAdministratorUserMutationDto(result: {\n  user: AdministratorUserSummary;\n  correlationId: string;\n}) {\n  return {\n    ...toAdministratorUserSummaryDto(result.user),\n    correlation_id: result.correlationId,\n  };\n}\n\nfunction translateAdministrationError(error: unknown): never {\n  if (error instanceof AdminRoleRequiredError) {\n    throw new ClientError('Administrator role required', 'forbidden', {\n      status: 403,\n      details: {required_role: error.minimumRole},\n    });\n  }\n  if (error instanceof InvalidAdminBootstrapTokenError) {\n    throw new ClientError('Bootstrap token is invalid', 'bootstrap-token-invalid', {\n      status: 403,\n    });\n  }\n  if (error instanceof AdminBootstrapClosedError) {\n    throw new ClientError('First administrator owner already exists', 'bootstrap-closed', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminGrantAlreadyExistsError) {\n    throw new ClientError('Administrator grant already exists', 'grant-already-exists', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminGrantNotFoundError) {\n    throw new ClientError('Administrator grant not found', 'not-found', {status: 404});\n  }\n  if (error instanceof UserNotFoundError) {\n    throw new ClientError('User not found', 'not-found', {status: 404});\n  }\n  if (error instanceof LastAdminOwnerError) {\n    throw new ClientError('Cannot remove the final active administrator owner', 'last-owner', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminIdempotencyKeyReuseError) {\n    throw new ClientError(\n      'Idempotency-Key was already used for a different command',\n      'idempotency-key-reused',\n      {status: 409},\n    );\n  }\n  throw error;\n}\n\nconst bootstrapRoute = defineRoute({\n  method: 'POST',\n  path: '/bootstrap',\n  description: 'Claim the first administrator owner role with the deployment bootstrap token.',\n  schema: {\n    body: bootstrapAdminOwnerBodySchema,\n    response: {201: bootstrapAdminOwnerResponseSchema},\n  },\n  preHandler: createAuthIpRateLimitPreHandler('bootstrap'),\n  errorHandler: translateAdministrationError,\n  handler: async (request, reply) => {\n    const actorId = requireActorId(request);\n    const grant = await bootstrapFirstAdminOwner({\n      actorId,\n      bootstrapToken: request.body.bootstrap_token,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    reply.code(201);\n    return toAdminGrantDto(grant);\n  },\n});\n\nconst bootstrapStateRoute = defineRoute({\n  method: 'GET',\n  path: '/bootstrap-state',\n  description: 'Read whether first administrator owner bootstrap is available.',\n  schema: {response: {200: adminBootstrapStateSchema}},\n  preHandler: createAuthIpRateLimitPreHandler('bootstrap-state'),\n  errorHandler: translateAdministrationError,\n  handler: async () => ({state: await getAdminBootstrapState()}),\n});\n\nconst listRoute = defineRoute({\n  method: 'GET',\n  path: '/',\n  description: 'List bounded local administrator grant summaries.',\n  schema: {\n    querystring: listAdminGrantsQuerySchema,\n    response: {200: listAdminGrantsResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const {limit, cursor} = request.query;\n    const decodedCursor = decodeTimestampIdCursor(cursor);\n    if (cursor && !decodedCursor) {\n      throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});\n    }\n\n    const result = await listAdministratorGrantSummaries({\n      actorId: requireActorId(request),\n      limit,\n      ...(decodedCursor ? {cursor: decodedCursor} : {}),\n    });\n    return {\n      grants: result.grants.map(toAdministratorGrantSummaryDto),\n      next_cursor: result.nextCursor ? encodeTimestampIdCursor(result.nextCursor) : null,\n    };\n  },\n});\n\nconst userLookupRoute = defineRoute({\n  method: 'GET',\n  path: '/',\n  description: 'Find one administrator-safe user summary by exact ID or email.',\n  schema: {\n    querystring: administratorUserLookupQuerySchema,\n    response: {200: administratorUserSummarySchema},\n  },\n  preHandler: [requireAdministratorObserver, createAuthIpRateLimitPreHandler('lookup')],\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const {id, user_id: userId, email} = request.query;\n    const lookupId = id ?? userId;\n    const actorId = requireActorId(request);\n    const user = lookupId\n      ? await findAdministratorUserSummary({actorId, id: lookupId})\n      : email\n        ? await findAdministratorUserSummary({actorId, email})\n        : undefined;\n    if (!user) throw new UserNotFoundError(lookupId ?? email ?? 'unknown');\n    return toAdministratorUserSummaryDto(user);\n  },\n});\n\nconst suspendUserRoute = defineRoute({\n  method: 'POST',\n  path: '/:userId/suspend',\n  description: 'Suspend a user and revoke all of its active sessions.',\n  schema: {\n    params: z.object({userId: z.string().uuid()}),\n    body: suspendAdministratorUserBodySchema,\n    response: {200: administratorUserMutationResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const result = await suspendAdministratorUser({\n      actorId: requireActorId(request),\n      userId: request.params.userId,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return toAdministratorUserMutationDto(result);\n  },\n});\n\nconst reactivateUserRoute = defineRoute({\n  method: 'POST',\n  path: '/:userId/reactivate',\n  description: 'Reactivate a suspended user without restoring revoked sessions.',\n  schema: {\n    params: z.object({userId: z.string().uuid()}),\n    body: reactivateAdministratorUserBodySchema,\n    response: {200: administratorUserMutationResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const result = await reactivateAdministratorUser({\n      actorId: requireActorId(request),\n      userId: request.params.userId,\n      ...(request.body.reason ? {reason: request.body.reason} : {}),\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return toAdministratorUserMutationDto(result);\n  },\n});\n\nconst revokeUserSessionsRoute = defineRoute({\n  method: 'POST',\n  path: '/:userId/revoke-sessions',\n  description: 'Revoke all active sessions for a user without changing account status.',\n  schema: {\n    params: z.object({userId: z.string().uuid()}),\n    body: revokeAdministratorUserSessionsBodySchema,\n    response: {200: revokeAdministratorUserSessionsResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const result = await revokeAdministratorUserSessions({\n      actorId: requireActorId(request),\n      userId: request.params.userId,\n      ...(request.body.reason ? {reason: request.body.reason} : {}),\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return {\n      ...toAdministratorUserMutationDto(result),\n      sessions_revoked: result.sessionsRevoked,\n    };\n  },\n});\n\nconst grantRoute = defineRoute({\n  method: 'POST',\n  path: '/',\n  description: 'Grant a local administrator role to an active user.',\n  schema: {\n    body: grantAdminRoleBodySchema,\n    response: {201: grantAdminRoleResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request, reply) => {\n    const actorId = requireActorId(request);\n    const grant = await grantAdministratorRole({\n      actorId,\n      userId: request.body.user_id,\n      role: request.body.role,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    reply.code(201);\n    return toAdminGrantDto(grant);\n  },\n});\n\nconst revokeRoute = defineRoute({\n  method: 'DELETE',\n  path: '/:grantId',\n  description: 'Revoke a local administrator grant.',\n  schema: {\n    params: z.object({grantId: z.string().uuid()}),\n    body: revokeAdminGrantBodySchema,\n    response: {200: revokeAdminGrantResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const grant = await revokeAdministratorGrant({\n      actorId: requireActorId(request),\n      grantId: request.params.grantId,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return toAdminGrantDto(grant);\n  },\n});\n\nexport const administrationRoutes: RouteGroup = {\n  prefix: '/admin/auth/admin-grants',\n  auth: AUTH_USER,\n  routes: [bootstrapRoute, listRoute, grantRoute, revokeRoute],\n};\n\nexport const administrationBootstrapRoutes: RouteGroup = {\n  prefix: '/admin/auth',\n  auth: AUTH_USER,\n  routes: [bootstrapStateRoute],\n};\n\nexport const administrationUserRoutes: RouteGroup = {\n  prefix: '/admin/auth/users',\n  auth: AUTH_USER,\n  routes: [userLookupRoute, suspendUserRoute, reactivateUserRoute, revokeUserSessionsRoute],\n};\n"],"names":["AUTH_USER","adminBootstrapStateSchema","administratorUserLookupQuerySchema","administratorUserMutationResponseSchema","administratorUserSummarySchema","bootstrapAdminOwnerBodySchema","bootstrapAdminOwnerResponseSchema","grantAdminRoleBodySchema","grantAdminRoleResponseSchema","listAdminGrantsQuerySchema","listAdminGrantsResponseSchema","reactivateAdministratorUserBodySchema","revokeAdminGrantBodySchema","revokeAdminGrantResponseSchema","revokeAdministratorUserSessionsBodySchema","revokeAdministratorUserSessionsResponseSchema","suspendAdministratorUserBodySchema","decodeTimestampIdCursor","encodeTimestampIdCursor","ClientError","defineRoute","z","requireAdminRole","bootstrapFirstAdminOwner","findAdministratorUserSummary","getAdminBootstrapState","grantAdministratorRole","listAdministratorGrantSummaries","reactivateAdministratorUser","revokeAdministratorGrant","revokeAdministratorUserSessions","suspendAdministratorUser","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","AdminRoleRequiredError","InvalidAdminBootstrapTokenError","LastAdminOwnerError","UserNotFoundError","getClientContext","createAuthIpRateLimitPreHandler","idempotencyKeyMaxLength","requireActorId","request","client","status","userId","requireIdempotencyKey","value","headers","key","Array","isArray","trim","length","requireAdministratorObserver","minimumRole","toAdminGrantDto","grant","id","user_id","role","revoked_at","revokedAt","toISOString","created_at","createdAt","updated_at","updatedAt","toAdministratorUserSummaryDto","user","email","name","email_verified_at","emailVerifiedAt","admin_role","adminRole","toAdministratorGrantSummaryDto","grant_id","grantId","toAdministratorUserMutationDto","result","correlation_id","correlationId","translateAdministrationError","error","details","required_role","bootstrapRoute","method","path","description","schema","body","response","preHandler","errorHandler","handler","reply","actorId","bootstrapToken","bootstrap_token","idempotencyKey","code","bootstrapStateRoute","state","listRoute","querystring","limit","cursor","query","decodedCursor","grants","map","next_cursor","nextCursor","userLookupRoute","lookupId","undefined","suspendUserRoute","params","object","string","uuid","reason","reactivateUserRoute","revokeUserSessionsRoute","sessions_revoked","sessionsRevoked","grantRoute","revokeRoute","administrationRoutes","prefix","auth","routes","administrationBootstrapRoutes","administrationUserRoutes"],"mappings":"AAAA,SAAQA,SAAS,QAAO,4BAA4B;AACpD,SACEC,yBAAyB,EACzBC,kCAAkC,EAClCC,uCAAuC,EACvCC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,iCAAiC,EACjCC,wBAAwB,EACxBC,4BAA4B,EAC5BC,0BAA0B,EAC1BC,6BAA6B,EAC7BC,qCAAqC,EACrCC,0BAA0B,EAC1BC,8BAA8B,EAC9BC,yCAAyC,EACzCC,6CAA6C,EAC7CC,kCAAkC,QAC7B,wBAAwB;AAC/B,SAAQC,uBAAuB,EAAEC,uBAAuB,QAAO,wBAAwB;AACvF,SAAQC,WAAW,EAAEC,WAAW,QAAwB,wBAAwB;AAEhF,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,gBAAgB,QAAO,sBAAsB;AACrD,SACEC,wBAAwB,EACxBC,4BAA4B,EAC5BC,sBAAsB,EACtBC,sBAAsB,EACtBC,+BAA+B,EAC/BC,2BAA2B,EAC3BC,wBAAwB,EACxBC,+BAA+B,EAC/BC,wBAAwB,QACnB,0BAA0B;AAMjC,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,sBAAsB,EACtBC,+BAA+B,EAC/BC,mBAAmB,EACnBC,iBAAiB,QACZ,kBAAkB;AACzB,SAAQC,gBAAgB,QAAO,iCAAiC;AAChE,SAAQC,+BAA+B,QAAO,kBAAkB;AAEhE,MAAMC,0BAA0B;AAEhC,SAASC,eAAeC,OAAuB;IAC7C,MAAMC,SAASL,iBAAiBI;IAChC,IAAI,CAACC,QAAQ;QACX,MAAM,IAAI1B,YAAY,2BAA2B,gBAAgB;YAAC2B,QAAQ;QAAG;IAC/E;IACA,OAAOD,OAAOE,MAAM;AACtB;AAEA,SAASC,sBAAsBJ,OAAuB;IACpD,MAAMK,QAAQL,QAAQM,OAAO,CAAC,kBAAkB;IAChD,MAAMC,MAAMC,MAAMC,OAAO,CAACJ,SAASA,KAAK,CAAC,EAAE,GAAGA;IAC9C,IAAI,CAACE,OAAOA,IAAIG,IAAI,GAAGC,MAAM,KAAK,KAAKJ,IAAII,MAAM,GAAGb,yBAAyB;QAC3E,MAAM,IAAIvB,YAAY,sCAAsC,4BAA4B;YACtF2B,QAAQ;QACV;IACF;IACA,OAAOK;AACT;AAEA,eAAeK,6BAA6BZ,OAAuB;IACjE,MAAMtB,iBAAiB;QAACyB,QAAQJ,eAAeC;QAAUa,aAAa;IAAgB;AACxF;AAEA,SAASC,gBAAgBC,KAAiB;IACxC,OAAO;QACLC,IAAID,MAAMC,EAAE;QACZC,SAASF,MAAMZ,MAAM;QACrBe,MAAMH,MAAMG,IAAI;QAChBC,YAAYJ,MAAMK,SAAS,EAAEC,iBAAiB;QAC9CC,YAAYP,MAAMQ,SAAS,CAACF,WAAW;QACvCG,YAAYT,MAAMU,SAAS,CAACJ,WAAW;IACzC;AACF;AAEA,SAASK,8BAA8BC,IAA8B;IACnE,OAAO;QACLX,IAAIW,KAAKX,EAAE;QACXY,OAAOD,KAAKC,KAAK;QACjBC,MAAMF,KAAKE,IAAI;QACf3B,QAAQyB,KAAKzB,MAAM;QACnB4B,mBAAmBH,KAAKI,eAAe,EAAEV,iBAAiB;QAC1DC,YAAYK,KAAKJ,SAAS,CAACF,WAAW;QACtCW,YAAYL,KAAKM,SAAS;IAC5B;AACF;AAEA,SAASC,+BAA+BnB,KAAgC;IACtE,OAAO;QACLoB,UAAUpB,MAAMqB,OAAO;QACvBlB,MAAMH,MAAMG,IAAI;QAChBI,YAAYP,MAAMQ,SAAS,CAACF,WAAW;QACvCF,YAAYJ,MAAMK,SAAS,EAAEC,iBAAiB;QAC9CM,MAAMZ,MAAMY,IAAI;IAClB;AACF;AAEA,SAASU,+BAA+BC,MAGvC;IACC,OAAO;QACL,GAAGZ,8BAA8BY,OAAOX,IAAI,CAAC;QAC7CY,gBAAgBD,OAAOE,aAAa;IACtC;AACF;AAEA,SAASC,6BAA6BC,KAAc;IAClD,IAAIA,iBAAiBlD,wBAAwB;QAC3C,MAAM,IAAIjB,YAAY,+BAA+B,aAAa;YAChE2B,QAAQ;YACRyC,SAAS;gBAACC,eAAeF,MAAM7B,WAAW;YAAA;QAC5C;IACF;IACA,IAAI6B,iBAAiBjD,iCAAiC;QACpD,MAAM,IAAIlB,YAAY,8BAA8B,2BAA2B;YAC7E2B,QAAQ;QACV;IACF;IACA,IAAIwC,iBAAiBtD,2BAA2B;QAC9C,MAAM,IAAIb,YAAY,4CAA4C,oBAAoB;YACpF2B,QAAQ;QACV;IACF;IACA,IAAIwC,iBAAiBrD,8BAA8B;QACjD,MAAM,IAAId,YAAY,sCAAsC,wBAAwB;YAClF2B,QAAQ;QACV;IACF;IACA,IAAIwC,iBAAiBpD,yBAAyB;QAC5C,MAAM,IAAIf,YAAY,iCAAiC,aAAa;YAAC2B,QAAQ;QAAG;IAClF;IACA,IAAIwC,iBAAiB/C,mBAAmB;QACtC,MAAM,IAAIpB,YAAY,kBAAkB,aAAa;YAAC2B,QAAQ;QAAG;IACnE;IACA,IAAIwC,iBAAiBhD,qBAAqB;QACxC,MAAM,IAAInB,YAAY,sDAAsD,cAAc;YACxF2B,QAAQ;QACV;IACF;IACA,IAAIwC,iBAAiBnD,+BAA+B;QAClD,MAAM,IAAIhB,YACR,4DACA,0BACA;YAAC2B,QAAQ;QAAG;IAEhB;IACA,MAAMwC;AACR;AAEA,MAAMG,iBAAiBrE,YAAY;IACjCsE,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMzF;QACN0F,UAAU;YAAC,KAAKzF;QAAiC;IACnD;IACA0F,YAAYvD,gCAAgC;IAC5CwD,cAAcZ;IACda,SAAS,OAAOtD,SAASuD;QACvB,MAAMC,UAAUzD,eAAeC;QAC/B,MAAMe,QAAQ,MAAMpC,yBAAyB;YAC3C6E;YACAC,gBAAgBzD,QAAQkD,IAAI,CAACQ,eAAe;YAC5CC,gBAAgBvD,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACAuC,MAAMK,IAAI,CAAC;QACX,OAAO9C,gBAAgBC;IACzB;AACF;AAEA,MAAM8C,sBAAsBrF,YAAY;IACtCsE,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QAACE,UAAU;YAAC,KAAK9F;QAAyB;IAAC;IACnD+F,YAAYvD,gCAAgC;IAC5CwD,cAAcZ;IACda,SAAS,UAAa,CAAA;YAACQ,OAAO,MAAMjF;QAAwB,CAAA;AAC9D;AAEA,MAAMkF,YAAYvF,YAAY;IAC5BsE,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNe,aAAanG;QACbsF,UAAU;YAAC,KAAKrF;QAA6B;IAC/C;IACAuF,cAAcZ;IACda,SAAS,OAAOtD;QACd,MAAM,EAACiE,KAAK,EAAEC,MAAM,EAAC,GAAGlE,QAAQmE,KAAK;QACrC,MAAMC,gBAAgB/F,wBAAwB6F;QAC9C,IAAIA,UAAU,CAACE,eAAe;YAC5B,MAAM,IAAI7F,YAAY,kBAAkB,kBAAkB;gBAAC2B,QAAQ;YAAG;QACxE;QAEA,MAAMoC,SAAS,MAAMvD,gCAAgC;YACnDyE,SAASzD,eAAeC;YACxBiE;YACA,GAAIG,gBAAgB;gBAACF,QAAQE;YAAa,IAAI,CAAC,CAAC;QAClD;QACA,OAAO;YACLC,QAAQ/B,OAAO+B,MAAM,CAACC,GAAG,CAACpC;YAC1BqC,aAAajC,OAAOkC,UAAU,GAAGlG,wBAAwBgE,OAAOkC,UAAU,IAAI;QAChF;IACF;AACF;AAEA,MAAMC,kBAAkBjG,YAAY;IAClCsE,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNe,aAAa1G;QACb6F,UAAU;YAAC,KAAK3F;QAA8B;IAChD;IACA4F,YAAY;QAACxC;QAA8Bf,gCAAgC;KAAU;IACrFwD,cAAcZ;IACda,SAAS,OAAOtD;QACd,MAAM,EAACgB,EAAE,EAAEC,SAASd,MAAM,EAAEyB,KAAK,EAAC,GAAG5B,QAAQmE,KAAK;QAClD,MAAMO,WAAW1D,MAAMb;QACvB,MAAMqD,UAAUzD,eAAeC;QAC/B,MAAM2B,OAAO+C,WACT,MAAM9F,6BAA6B;YAAC4E;YAASxC,IAAI0D;QAAQ,KACzD9C,QACE,MAAMhD,6BAA6B;YAAC4E;YAAS5B;QAAK,KAClD+C;QACN,IAAI,CAAChD,MAAM,MAAM,IAAIhC,kBAAkB+E,YAAY9C,SAAS;QAC5D,OAAOF,8BAA8BC;IACvC;AACF;AAEA,MAAMiD,mBAAmBpG,YAAY;IACnCsE,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACN4B,QAAQpG,EAAEqG,MAAM,CAAC;YAAC3E,QAAQ1B,EAAEsG,MAAM,GAAGC,IAAI;QAAE;QAC3C9B,MAAM9E;QACN+E,UAAU;YAAC,KAAK5F;QAAuC;IACzD;IACA8F,cAAcZ;IACda,SAAS,OAAOtD;QACd,MAAMsC,SAAS,MAAMnD,yBAAyB;YAC5CqE,SAASzD,eAAeC;YACxBG,QAAQH,QAAQ6E,MAAM,CAAC1E,MAAM;YAC7B8E,QAAQjF,QAAQkD,IAAI,CAAC+B,MAAM;YAC3BtB,gBAAgBvD,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA,OAAOqB,+BAA+BC;IACxC;AACF;AAEA,MAAM4C,sBAAsB1G,YAAY;IACtCsE,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACN4B,QAAQpG,EAAEqG,MAAM,CAAC;YAAC3E,QAAQ1B,EAAEsG,MAAM,GAAGC,IAAI;QAAE;QAC3C9B,MAAMnF;QACNoF,UAAU;YAAC,KAAK5F;QAAuC;IACzD;IACA8F,cAAcZ;IACda,SAAS,OAAOtD;QACd,MAAMsC,SAAS,MAAMtD,4BAA4B;YAC/CwE,SAASzD,eAAeC;YACxBG,QAAQH,QAAQ6E,MAAM,CAAC1E,MAAM;YAC7B,GAAIH,QAAQkD,IAAI,CAAC+B,MAAM,GAAG;gBAACA,QAAQjF,QAAQkD,IAAI,CAAC+B,MAAM;YAAA,IAAI,CAAC,CAAC;YAC5DtB,gBAAgBvD,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA,OAAOqB,+BAA+BC;IACxC;AACF;AAEA,MAAM6C,0BAA0B3G,YAAY;IAC1CsE,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACN4B,QAAQpG,EAAEqG,MAAM,CAAC;YAAC3E,QAAQ1B,EAAEsG,MAAM,GAAGC,IAAI;QAAE;QAC3C9B,MAAMhF;QACNiF,UAAU;YAAC,KAAKhF;QAA6C;IAC/D;IACAkF,cAAcZ;IACda,SAAS,OAAOtD;QACd,MAAMsC,SAAS,MAAMpD,gCAAgC;YACnDsE,SAASzD,eAAeC;YACxBG,QAAQH,QAAQ6E,MAAM,CAAC1E,MAAM;YAC7B,GAAIH,QAAQkD,IAAI,CAAC+B,MAAM,GAAG;gBAACA,QAAQjF,QAAQkD,IAAI,CAAC+B,MAAM;YAAA,IAAI,CAAC,CAAC;YAC5DtB,gBAAgBvD,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA,OAAO;YACL,GAAGqB,+BAA+BC,OAAO;YACzC8C,kBAAkB9C,OAAO+C,eAAe;QAC1C;IACF;AACF;AAEA,MAAMC,aAAa9G,YAAY;IAC7BsE,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMvF;QACNwF,UAAU;YAAC,KAAKvF;QAA4B;IAC9C;IACAyF,cAAcZ;IACda,SAAS,OAAOtD,SAASuD;QACvB,MAAMC,UAAUzD,eAAeC;QAC/B,MAAMe,QAAQ,MAAMjC,uBAAuB;YACzC0E;YACArD,QAAQH,QAAQkD,IAAI,CAACjC,OAAO;YAC5BC,MAAMlB,QAAQkD,IAAI,CAAChC,IAAI;YACvB+D,QAAQjF,QAAQkD,IAAI,CAAC+B,MAAM;YAC3BtB,gBAAgBvD,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACAuC,MAAMK,IAAI,CAAC;QACX,OAAO9C,gBAAgBC;IACzB;AACF;AAEA,MAAMwE,cAAc/G,YAAY;IAC9BsE,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACN4B,QAAQpG,EAAEqG,MAAM,CAAC;YAAC1C,SAAS3D,EAAEsG,MAAM,GAAGC,IAAI;QAAE;QAC5C9B,MAAMlF;QACNmF,UAAU;YAAC,KAAKlF;QAA8B;IAChD;IACAoF,cAAcZ;IACda,SAAS,OAAOtD;QACd,MAAMe,QAAQ,MAAM9B,yBAAyB;YAC3CuE,SAASzD,eAAeC;YACxBoC,SAASpC,QAAQ6E,MAAM,CAACzC,OAAO;YAC/B6C,QAAQjF,QAAQkD,IAAI,CAAC+B,MAAM;YAC3BtB,gBAAgBvD,sBAAsBJ;YACtCwC,eAAexC,QAAQgB,EAAE;QAC3B;QACA,OAAOF,gBAAgBC;IACzB;AACF;AAEA,OAAO,MAAMyE,uBAAmC;IAC9CC,QAAQ;IACRC,MAAMtI;IACNuI,QAAQ;QAAC9C;QAAgBkB;QAAWuB;QAAYC;KAAY;AAC9D,EAAE;AAEF,OAAO,MAAMK,gCAA4C;IACvDH,QAAQ;IACRC,MAAMtI;IACNuI,QAAQ;QAAC9B;KAAoB;AAC/B,EAAE;AAEF,OAAO,MAAMgC,2BAAuC;IAClDJ,QAAQ;IACRC,MAAMtI;IACNuI,QAAQ;QAAClB;QAAiBG;QAAkBM;QAAqBC;KAAwB;AAC3F,EAAE"}

package/dist/presentation/routes/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACL,KAAK,mBAAmB,EAMzB,MAAM,qBAAqB,CAAC;AAsB7B,UAAU,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAgFD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,IACzD,SAAS,cAAc,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,CAAC,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,IAC3D,SAAS,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAS3E"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACL,KAAK,mBAAmB,EAMzB,MAAM,qBAAqB,CAAC;AAyB7B,UAAU,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAgFD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,IACzD,SAAS,cAAc,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,CAAC,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,IAC3D,SAAS,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAS3E"}

package/dist/presentation/routes/rate-limit.js

@@ -27,6 +27,12 @@ const policies = {
             windowSeconds: 15 * 60
         }
     },
+    'bootstrap-state': {
+        ip: {
+            limit: 60,
+            windowSeconds: 5 * 60
+        }
+    },
     lookup: {
         ip: {
             limit: 60,

package/dist/presentation/routes/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/rate-limit.ts"],"sourcesContent":["import {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';\nimport {\n  type AuthRateLimitAction,\n  AuthRateLimitExceededError,\n  type AuthRateLimitPolicy,\n  type AuthRateLimitScope,\n  AuthRateLimitUnavailableError,\n  checkAuthRateLimit,\n} from '#core/rate-limit.js';\n\nconst policies: Record<\n  AuthRateLimitAction,\n  Partial<Record<AuthRateLimitScope, AuthRateLimitPolicy>>\n> = {\n  login: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    email: {limit: 10, windowSeconds: 15 * 60},\n  },\n  'email-send': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n    email: {limit: 3, windowSeconds: 60 * 60},\n  },\n  bootstrap: {\n    ip: {limit: 5, windowSeconds: 15 * 60},\n  },\n  lookup: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n};\n\ninterface EmailBody {\n  email: string;\n}\n\nfunction routeName(request: FastifyRequest): string {\n  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';\n}\n\nasync function enforceRateLimit(params: {\n  request: FastifyRequest;\n  reply: FastifyReply;\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): Promise<void> {\n  const policy = policies[params.action][params.scope];\n  if (!policy) return;\n\n  try {\n    await checkAuthRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      ...policy,\n    });\n  } catch (error) {\n    if (error instanceof AuthRateLimitExceededError) {\n      params.request.log.warn(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          retryAfterSeconds: error.retryAfterSeconds,\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        'Auth rate limit blocked request',\n      );\n      params.reply.header('Retry-After', String(error.retryAfterSeconds));\n      throw new ClientError('Rate limit exceeded', 'rate-limited', {\n        status: 429,\n        details: {retry_after_seconds: error.retryAfterSeconds},\n        data: {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        cause: error,\n      });\n    }\n\n    if (error instanceof AuthRateLimitUnavailableError) {\n      params.request.log.error(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n          err: error,\n        },\n        'Auth rate limiter unavailable',\n      );\n      throw new ClientError(\n        'Authentication rate limiter unavailable',\n        'auth-rate-limit-unavailable',\n        {\n          status: 503,\n          data: {\n            action: error.action,\n            scope: error.scope,\n            route: routeName(params.request),\n            identifierHmacPrefix: error.identifierHmacPrefix,\n          },\n          cause: error,\n        },\n      );\n    }\n\n    throw error;\n  }\n}\n\nexport function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest<{Body: EmailBody}>, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'email',\n      identifier: request.body.email,\n    });\n  };\n}\n\nexport function createAuthIpRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n  };\n}\n"],"names":["ClientError","AuthRateLimitExceededError","AuthRateLimitUnavailableError","checkAuthRateLimit","policies","login","ip","limit","windowSeconds","email","bootstrap","lookup","routeName","request","routeOptions","url","split","enforceRateLimit","params","policy","action","scope","identifier","error","log","warn","route","retryAfterSeconds","identifierHmacPrefix","reply","header","String","status","details","retry_after_seconds","data","cause","err","createAuthRateLimitPreHandler","body","createAuthIpRateLimitPreHandler"],"mappings":"AAAA,SAAQA,WAAW,QAA+C,wBAAwB;AAC1F,SAEEC,0BAA0B,EAG1BC,6BAA6B,EAC7BC,kBAAkB,QACb,sBAAsB;AAE7B,MAAMC,WAGF;IACFC,OAAO;QACLC,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCC,OAAO;YAACF,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCC,OAAO;YAACF,OAAO;YAAGC,eAAe,KAAK;QAAE;IAC1C;IACAE,WAAW;QACTJ,IAAI;YAACC,OAAO;YAAGC,eAAe,KAAK;QAAE;IACvC;IACAG,QAAQ;QACNL,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;AACF;AAMA,SAASI,UAAUC,OAAuB;IACxC,OAAOA,QAAQC,YAAY,CAACC,GAAG,IAAIF,QAAQE,GAAG,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI;AAClE;AAEA,eAAeC,iBAAiBC,MAM/B;IACC,MAAMC,SAASf,QAAQ,CAACc,OAAOE,MAAM,CAAC,CAACF,OAAOG,KAAK,CAAC;IACpD,IAAI,CAACF,QAAQ;IAEb,IAAI;QACF,MAAMhB,mBAAmB;YACvBiB,QAAQF,OAAOE,MAAM;YACrBC,OAAOH,OAAOG,KAAK;YACnBC,YAAYJ,OAAOI,UAAU;YAC7B,GAAGH,MAAM;QACX;IACF,EAAE,OAAOI,OAAO;QACd,IAAIA,iBAAiBtB,4BAA4B;YAC/CiB,OAAOL,OAAO,CAACW,GAAG,CAACC,IAAI,CACrB;gBACEL,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOd,UAAUM,OAAOL,OAAO;gBAC/Bc,mBAAmBJ,MAAMI,iBAAiB;gBAC1CC,sBAAsBL,MAAMK,oBAAoB;YAClD,GACA;YAEFV,OAAOW,KAAK,CAACC,MAAM,CAAC,eAAeC,OAAOR,MAAMI,iBAAiB;YACjE,MAAM,IAAI3B,YAAY,uBAAuB,gBAAgB;gBAC3DgC,QAAQ;gBACRC,SAAS;oBAACC,qBAAqBX,MAAMI,iBAAiB;gBAAA;gBACtDQ,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOd,UAAUM,OAAOL,OAAO;oBAC/Be,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QACF;QAEA,IAAIA,iBAAiBrB,+BAA+B;YAClDgB,OAAOL,OAAO,CAACW,GAAG,CAACD,KAAK,CACtB;gBACEH,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOd,UAAUM,OAAOL,OAAO;gBAC/Be,sBAAsBL,MAAMK,oBAAoB;gBAChDS,KAAKd;YACP,GACA;YAEF,MAAM,IAAIvB,YACR,2CACA,+BACA;gBACEgC,QAAQ;gBACRG,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOd,UAAUM,OAAOL,OAAO;oBAC/Be,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QAEJ;QAEA,MAAMA;IACR;AACF;AAEA,OAAO,SAASe,8BAA8BlB,MAA2B;IACvE,OAAO,OAAOP,SAA4CgB;QACxD,MAAMZ,iBAAiB;YACrBJ;YACAgB;YACAT;YACAC,OAAO;YACPC,YAAYT,QAAQP,EAAE;QACxB;QAEA,MAAMW,iBAAiB;YACrBJ;YACAgB;YACAT;YACAC,OAAO;YACPC,YAAYT,QAAQ0B,IAAI,CAAC9B,KAAK;QAChC;IACF;AACF;AAEA,OAAO,SAAS+B,gCAAgCpB,MAA2B;IACzE,OAAO,OAAOP,SAAyBgB;QACrC,MAAMZ,iBAAiB;YACrBJ;YACAgB;YACAT;YACAC,OAAO;YACPC,YAAYT,QAAQP,EAAE;QACxB;IACF;AACF"}
+{"version":3,"sources":["../../../src/presentation/routes/rate-limit.ts"],"sourcesContent":["import {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';\nimport {\n  type AuthRateLimitAction,\n  AuthRateLimitExceededError,\n  type AuthRateLimitPolicy,\n  type AuthRateLimitScope,\n  AuthRateLimitUnavailableError,\n  checkAuthRateLimit,\n} from '#core/rate-limit.js';\n\nconst policies: Record<\n  AuthRateLimitAction,\n  Partial<Record<AuthRateLimitScope, AuthRateLimitPolicy>>\n> = {\n  login: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    email: {limit: 10, windowSeconds: 15 * 60},\n  },\n  'email-send': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n    email: {limit: 3, windowSeconds: 60 * 60},\n  },\n  bootstrap: {\n    ip: {limit: 5, windowSeconds: 15 * 60},\n  },\n  'bootstrap-state': {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n  lookup: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n};\n\ninterface EmailBody {\n  email: string;\n}\n\nfunction routeName(request: FastifyRequest): string {\n  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';\n}\n\nasync function enforceRateLimit(params: {\n  request: FastifyRequest;\n  reply: FastifyReply;\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): Promise<void> {\n  const policy = policies[params.action][params.scope];\n  if (!policy) return;\n\n  try {\n    await checkAuthRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      ...policy,\n    });\n  } catch (error) {\n    if (error instanceof AuthRateLimitExceededError) {\n      params.request.log.warn(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          retryAfterSeconds: error.retryAfterSeconds,\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        'Auth rate limit blocked request',\n      );\n      params.reply.header('Retry-After', String(error.retryAfterSeconds));\n      throw new ClientError('Rate limit exceeded', 'rate-limited', {\n        status: 429,\n        details: {retry_after_seconds: error.retryAfterSeconds},\n        data: {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        cause: error,\n      });\n    }\n\n    if (error instanceof AuthRateLimitUnavailableError) {\n      params.request.log.error(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n          err: error,\n        },\n        'Auth rate limiter unavailable',\n      );\n      throw new ClientError(\n        'Authentication rate limiter unavailable',\n        'auth-rate-limit-unavailable',\n        {\n          status: 503,\n          data: {\n            action: error.action,\n            scope: error.scope,\n            route: routeName(params.request),\n            identifierHmacPrefix: error.identifierHmacPrefix,\n          },\n          cause: error,\n        },\n      );\n    }\n\n    throw error;\n  }\n}\n\nexport function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest<{Body: EmailBody}>, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'email',\n      identifier: request.body.email,\n    });\n  };\n}\n\nexport function createAuthIpRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n  };\n}\n"],"names":["ClientError","AuthRateLimitExceededError","AuthRateLimitUnavailableError","checkAuthRateLimit","policies","login","ip","limit","windowSeconds","email","bootstrap","lookup","routeName","request","routeOptions","url","split","enforceRateLimit","params","policy","action","scope","identifier","error","log","warn","route","retryAfterSeconds","identifierHmacPrefix","reply","header","String","status","details","retry_after_seconds","data","cause","err","createAuthRateLimitPreHandler","body","createAuthIpRateLimitPreHandler"],"mappings":"AAAA,SAAQA,WAAW,QAA+C,wBAAwB;AAC1F,SAEEC,0BAA0B,EAG1BC,6BAA6B,EAC7BC,kBAAkB,QACb,sBAAsB;AAE7B,MAAMC,WAGF;IACFC,OAAO;QACLC,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCC,OAAO;YAACF,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCC,OAAO;YAACF,OAAO;YAAGC,eAAe,KAAK;QAAE;IAC1C;IACAE,WAAW;QACTJ,IAAI;YAACC,OAAO;YAAGC,eAAe,KAAK;QAAE;IACvC;IACA,mBAAmB;QACjBF,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;IACAG,QAAQ;QACNL,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;AACF;AAMA,SAASI,UAAUC,OAAuB;IACxC,OAAOA,QAAQC,YAAY,CAACC,GAAG,IAAIF,QAAQE,GAAG,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI;AAClE;AAEA,eAAeC,iBAAiBC,MAM/B;IACC,MAAMC,SAASf,QAAQ,CAACc,OAAOE,MAAM,CAAC,CAACF,OAAOG,KAAK,CAAC;IACpD,IAAI,CAACF,QAAQ;IAEb,IAAI;QACF,MAAMhB,mBAAmB;YACvBiB,QAAQF,OAAOE,MAAM;YACrBC,OAAOH,OAAOG,KAAK;YACnBC,YAAYJ,OAAOI,UAAU;YAC7B,GAAGH,MAAM;QACX;IACF,EAAE,OAAOI,OAAO;QACd,IAAIA,iBAAiBtB,4BAA4B;YAC/CiB,OAAOL,OAAO,CAACW,GAAG,CAACC,IAAI,CACrB;gBACEL,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOd,UAAUM,OAAOL,OAAO;gBAC/Bc,mBAAmBJ,MAAMI,iBAAiB;gBAC1CC,sBAAsBL,MAAMK,oBAAoB;YAClD,GACA;YAEFV,OAAOW,KAAK,CAACC,MAAM,CAAC,eAAeC,OAAOR,MAAMI,iBAAiB;YACjE,MAAM,IAAI3B,YAAY,uBAAuB,gBAAgB;gBAC3DgC,QAAQ;gBACRC,SAAS;oBAACC,qBAAqBX,MAAMI,iBAAiB;gBAAA;gBACtDQ,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOd,UAAUM,OAAOL,OAAO;oBAC/Be,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QACF;QAEA,IAAIA,iBAAiBrB,+BAA+B;YAClDgB,OAAOL,OAAO,CAACW,GAAG,CAACD,KAAK,CACtB;gBACEH,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOd,UAAUM,OAAOL,OAAO;gBAC/Be,sBAAsBL,MAAMK,oBAAoB;gBAChDS,KAAKd;YACP,GACA;YAEF,MAAM,IAAIvB,YACR,2CACA,+BACA;gBACEgC,QAAQ;gBACRG,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOd,UAAUM,OAAOL,OAAO;oBAC/Be,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QAEJ;QAEA,MAAMA;IACR;AACF;AAEA,OAAO,SAASe,8BAA8BlB,MAA2B;IACvE,OAAO,OAAOP,SAA4CgB;QACxD,MAAMZ,iBAAiB;YACrBJ;YACAgB;YACAT;YACAC,OAAO;YACPC,YAAYT,QAAQP,EAAE;QACxB;QAEA,MAAMW,iBAAiB;YACrBJ;YACAgB;YACAT;YACAC,OAAO;YACPC,YAAYT,QAAQ0B,IAAI,CAAC9B,KAAK;QAChC;IACF;AACF;AAEA,OAAO,SAAS+B,gCAAgCpB,MAA2B;IACzE,OAAO,OAAOP,SAAyBgB;QACrC,MAAMZ,iBAAiB;YACrBJ;YACAgB;YACAT;YACAC,OAAO;YACPC,YAAYT,QAAQP,EAAE;QACxB;IACF;AACF"}