@shipfox/api-auth 10.2.0 → 12.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-auth",
   "license": "MIT",
-  "version": "10.2.0",
+  "version": "12.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -26,24 +26,24 @@
     "@node-rs/argon2": "^2.0.2",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-common-dto": "9.2.0",
-    "@shipfox/api-auth-context": "10.2.0",
-    "@shipfox/api-auth-dto": "10.2.0",
-    "@shipfox/api-email-challenges": "1.1.6",
-    "@shipfox/api-workspaces-dto": "10.2.0",
-    "@shipfox/inter-module": "0.2.2",
+    "@shipfox/api-common-dto": "12.0.0",
+    "@shipfox/api-auth-context": "12.0.0",
+    "@shipfox/api-auth-dto": "12.0.0",
+    "@shipfox/api-email-challenges": "1.1.7",
+    "@shipfox/api-workspaces-dto": "12.0.0",
+    "@shipfox/inter-module": "0.2.3",
     "@shipfox/config": "1.2.4",
-    "@shipfox/node-drizzle": "0.3.4",
+    "@shipfox/node-drizzle": "0.3.5",
     "@shipfox/node-auth-root-key": "0.2.3",
-    "@shipfox/node-fastify": "0.4.0",
-    "@shipfox/node-jwt": "0.3.2",
+    "@shipfox/node-fastify": "0.4.1",
+    "@shipfox/node-jwt": "0.4.0",
     "@shipfox/node-email": "0.3.4",
     "@shipfox/node-mailer": "0.2.4",
-    "@shipfox/node-module": "1.0.4",
+    "@shipfox/node-module": "1.0.5",
     "@shipfox/node-opentelemetry": "0.6.3",
     "@shipfox/node-outbox": "0.2.6",
-    "@shipfox/node-postgres": "0.4.4",
-    "@shipfox/node-rate-limit": "0.3.2",
+    "@shipfox/node-postgres": "0.5.0",
+    "@shipfox/node-rate-limit": "0.4.0",
     "@shipfox/node-tokens": "0.3.2"
   },
   "imports": {

package/src/core/auth.test.ts

@@ -73,7 +73,13 @@ vi.mock('#config.js', () => ({
 vi.mock('@shipfox/node-mailer', () => ({mailer: testConfig.mailer}));
 
 const listMembershipsByUserMock = vi.fn(() =>
-  Promise.resolve({memberships: [] as Array<{workspaceId: string; role: 'admin'}>}),
+  Promise.resolve({
+    memberships: [] as Array<{
+      workspaceId: string;
+      role: 'admin';
+      workspaceStatus: 'active' | 'suspended' | 'deleted';
+    }>,
+  }),
 );
 const workspaces = {
   listMembershipsForTokenClaims: listMembershipsByUserMock,
@@ -492,7 +498,6 @@ describe('auth core', () => {
   test('refreshAccessToken rejects a lost rotation claim when the token was revoked', async () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
     const loginResult = await login({email: user.email, password: user.plainPassword});
-    listMembershipsByUserMock.mockClear();
     vi.spyOn(refreshTokenDb, 'rotateRefreshToken').mockImplementationOnce(async () => {
       await logout({refreshToken: loginResult.refreshToken});
       return undefined;
@@ -501,7 +506,9 @@ describe('auth core', () => {
     const raced = refreshAccessToken({refreshToken: loginResult.refreshToken});
 
     await expect(raced).rejects.toBeInstanceOf(TokenInvalidError);
-    expect(listMembershipsByUserMock).not.toHaveBeenCalled();
+    await expect(
+      verifyUserToken({token: loginResult.token, secret: userAccessTokenKey()}),
+    ).resolves.toMatchObject({sub: user.id});
   });
 
   test('refreshAccessToken rejects reuse past the grace window and revokes the session', async () => {
@@ -524,6 +531,9 @@ describe('auth core', () => {
         })
       : undefined;
     expect(successor).toBeUndefined();
+    await expect(
+      verifyUserToken({token: refreshed.token, secret: userAccessTokenKey()}),
+    ).resolves.toMatchObject({sub: user.id});
   });
 
   test('refreshAccessToken rejects refresh tokens for inactive users', async () => {
@@ -597,6 +607,9 @@ describe('auth core', () => {
 
     expect(currentRefresh.user.id).toBe(user.id);
     await expect(otherRefresh).rejects.toBeInstanceOf(TokenInvalidError);
+    await expect(
+      verifyUserToken({token: loginResult.token, secret: userAccessTokenKey()}),
+    ).resolves.toMatchObject({sub: user.id});
   });
 
   test('changePassword rejects unknown users and invalid current passwords', async () => {
@@ -696,8 +709,8 @@ describe('auth core', () => {
     const workspaceB = crypto.randomUUID();
     listMembershipsByUserMock.mockResolvedValueOnce({
       memberships: [
-        {workspaceId: workspaceA, role: 'admin'},
-        {workspaceId: workspaceB, role: 'admin'},
+        {workspaceId: workspaceA, role: 'admin', workspaceStatus: 'active'},
+        {workspaceId: workspaceB, role: 'admin', workspaceStatus: 'suspended'},
       ],
     });
 
@@ -706,8 +719,8 @@ describe('auth core', () => {
     const claims = await verifyUserToken({token: result.token, secret: userAccessTokenKey()});
     expect(claims.name).toBe(user.name);
     expect(claims.memberships).toEqual([
-      {workspaceId: workspaceA, role: 'admin'},
-      {workspaceId: workspaceB, role: 'admin'},
+      {workspaceId: workspaceA, role: 'admin', workspaceStatus: 'active'},
+      {workspaceId: workspaceB, role: 'admin', workspaceStatus: 'suspended'},
     ]);
   });
 
@@ -718,7 +731,7 @@ describe('auth core', () => {
 
     const newWorkspaceId = crypto.randomUUID();
     listMembershipsByUserMock.mockResolvedValueOnce({
-      memberships: [{workspaceId: newWorkspaceId, role: 'admin'}],
+      memberships: [{workspaceId: newWorkspaceId, role: 'admin', workspaceStatus: 'active'}],
     });
     const refreshed = await refreshAccessToken({refreshToken: loginResult.refreshToken});
 
@@ -726,7 +739,9 @@ describe('auth core', () => {
       token: refreshed.token,
       secret: userAccessTokenKey(),
     });
-    expect(refreshedClaims.memberships).toEqual([{workspaceId: newWorkspaceId, role: 'admin'}]);
+    expect(refreshedClaims.memberships).toEqual([
+      {workspaceId: newWorkspaceId, role: 'admin', workspaceStatus: 'active'},
+    ]);
   });
 
   test('login fails closed when listMembershipsByUser throws', async () => {
@@ -738,7 +753,7 @@ describe('auth core', () => {
     await expect(promise).rejects.toBeInstanceOf(AuthDependencyUnavailableError);
   });
 
-  test('refresh fails closed when listMembershipsByUser throws', async () => {
+  test('does not rotate a refresh token when listMembershipsByUser throws', async () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
     listMembershipsByUserMock.mockResolvedValueOnce({memberships: []});
     const loginResult = await login({email: user.email, password: user.plainPassword});
@@ -747,5 +762,9 @@ describe('auth core', () => {
     const promise = refreshAccessToken({refreshToken: loginResult.refreshToken});
 
     await expect(promise).rejects.toBeInstanceOf(AuthDependencyUnavailableError);
+
+    const retry = await refreshAccessToken({refreshToken: loginResult.refreshToken});
+    expect(retry.token).toEqual(expect.any(String));
+    expect(retry.refreshToken).toEqual(expect.any(String));
   });
 });

package/src/core/auth.ts

@@ -46,7 +46,7 @@ import {
   TokenInvalidError,
   UserNotFoundError,
 } from './errors.js';
-import {signUserToken} from './jwt.js';
+import {signUserToken, type TokenMembership} from './jwt.js';
 import {hashPassword, verifyPassword} from './password.js';
 import type {SignupPolicy} from './ports.js';
 import {createEnvironmentSignupPolicy} from './signup-policy.js';
@@ -95,21 +95,30 @@ function recordRefreshOutcome(outcome: AuthTokenRefreshOutcome): void {
   recordTokenRefreshed(outcome);
 }
 
-async function signAccessToken(
-  user: User,
+type TokenMemberships = TokenMembership[];
+
+async function loadTokenMemberships(
+  userId: string,
   workspaces: WorkspacesInterModuleClient,
-  refreshSessionId: string,
-): Promise<string> {
+): Promise<TokenMemberships> {
   const memberships = await workspaces
-    .listMembershipsForTokenClaims({userId: user.id})
+    .listMembershipsForTokenClaims({userId})
     .catch((error: unknown) => {
       throw new AuthDependencyUnavailableError('workspaces', error);
     });
+  return memberships.memberships;
+}
+
+async function signAccessToken(
+  user: User,
+  memberships: TokenMemberships,
+  refreshSessionId: string,
+): Promise<string> {
   return await signUserToken({
     userId: user.id,
     email: user.email,
     name: user.name,
-    memberships: memberships.memberships,
+    memberships,
     refreshSessionId,
     secret: userAccessTokenKey(),
     expiresIn: config.AUTH_JWT_EXPIRES_IN,
@@ -142,7 +151,8 @@ async function createSessionTokens(
   workspaces: WorkspacesInterModuleClient,
 ): Promise<{token: string; refreshToken: string; adminRole: AdminRole | null}> {
   const refreshSessionId = crypto.randomUUID();
-  const token = await signAccessToken(user, workspaces, refreshSessionId);
+  const memberships = await loadTokenMemberships(user.id, workspaces);
+  const token = await signAccessToken(user, memberships, refreshSessionId);
   const adminRole = await getCurrentAdminRole({userId: user.id});
   const {refreshToken} = await createRefreshSession(user, refreshSessionId);
   return {token, refreshToken, adminRole};
@@ -335,7 +345,7 @@ export async function signupWithInvitation(
     }
   }
 
-  // Step 4: Issue session. signAccessToken reads memberships through the
+  // Step 4: Issue session. createSessionTokens reads memberships through the
   // workspaces module API, so a successful accept is reflected in the JWT.
   const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);
 
@@ -479,7 +489,8 @@ export async function refreshAccessToken(params: {
   // second tab); past it, reuse of a retired token means a compromised session.
   if (current.rotatedAt) {
     if (isWithinRotationGrace(current)) {
-      const token = await signAccessToken(user, params.workspaces, current.sessionId);
+      const memberships = await loadTokenMemberships(user.id, params.workspaces);
+      const token = await signAccessToken(user, memberships, current.sessionId);
       recordRefreshOutcome('grace');
       return {token, refreshToken: undefined, user, adminRole};
     }
@@ -488,6 +499,10 @@ export async function refreshAccessToken(params: {
     throw new TokenInvalidError('Refresh token reused after rotation');
   }
 
+  // Keep the external membership snapshot ahead of rotation so an outage
+  // cannot retire a refresh token that the caller can still retry.
+  const memberships = await loadTokenMemberships(user.id, params.workspaces);
+
   // Losing the CAS requires a state check: another request may have rotated,
   // revoked, or expired the token before this refresh could claim it.
   const nextRefreshToken = generateOpaqueToken('refreshToken');
@@ -509,12 +524,12 @@ export async function refreshAccessToken(params: {
       recordRefreshOutcome('rejected');
       throw new TokenInvalidError('Refresh token is invalid or expired');
     }
-    const token = await signAccessToken(user, params.workspaces, latest.sessionId);
+    const token = await signAccessToken(user, memberships, latest.sessionId);
     recordRefreshOutcome('grace');
     return {token, refreshToken: undefined, user, adminRole};
   }
 
-  const token = await signAccessToken(user, params.workspaces, current.sessionId);
+  const token = await signAccessToken(user, memberships, current.sessionId);
   recordRefreshOutcome('rotated');
   return {token, refreshToken: nextRefreshToken, user, adminRole};
 }

package/src/core/job-lease-token.ts

@@ -66,7 +66,7 @@ export async function issueJobLeaseToken(claims: IssueJobLeaseTokenParams): Prom
   return token;
 }
 
-/** Returns the claims on success, or `null` for any invalid input — never throws. */
+/** Returns the claims on success, or `null` for any invalid input. Never throws. */
 export async function verifyJobLeaseToken(token: string): Promise<JobLeaseTokenClaims | null> {
   try {
     const claims = await verifyHs256({

package/src/core/jwt.test.ts

@@ -12,8 +12,8 @@ describe('jwt', () => {
     const userId = crypto.randomUUID();
     const email = `jwt-${crypto.randomUUID()}@example.com`;
     const memberships: TokenMembership[] = [
-      {workspaceId: crypto.randomUUID(), role: 'admin'},
-      {workspaceId: crypto.randomUUID(), role: 'admin'},
+      {workspaceId: crypto.randomUUID(), role: 'admin', workspaceStatus: 'active'},
+      {workspaceId: crypto.randomUUID(), role: 'admin', workspaceStatus: 'suspended'},
     ];
 
     const token = await signUserToken({
@@ -140,7 +140,7 @@ describe('jwt', () => {
   test('rejects a token with non-UUID workspaceId in memberships', async () => {
     const token = await new SignJWT({
       email: `jwt-${crypto.randomUUID()}@example.com`,
-      memberships: [{workspaceId: 'not-a-uuid', role: 'admin'}],
+      memberships: [{workspaceId: 'not-a-uuid', role: 'admin', workspaceStatus: 'active'}],
     })
       .setProtectedHeader({alg: 'HS256'})
       .setSubject(crypto.randomUUID())
@@ -151,10 +151,26 @@ describe('jwt', () => {
     await expect(verifyUserToken({token, secret: SECRET})).rejects.toThrow();
   });
 
+  test('accepts legacy tokens with missing workspace status as active', async () => {
+    const token = await new SignJWT({
+      email: `jwt-${crypto.randomUUID()}@example.com`,
+      memberships: [{workspaceId: crypto.randomUUID(), role: 'admin'}],
+    })
+      .setProtectedHeader({alg: 'HS256'})
+      .setSubject(crypto.randomUUID())
+      .setIssuedAt()
+      .setExpirationTime('7d')
+      .sign(encodeSecret(SECRET));
+
+    await expect(verifyUserToken({token, secret: SECRET})).resolves.toMatchObject({
+      memberships: [{workspaceId: expect.any(String), role: 'admin', workspaceStatus: 'active'}],
+    });
+  });
+
   test('rejects a token with unknown role value', async () => {
     const token = await new SignJWT({
       email: `jwt-${crypto.randomUUID()}@example.com`,
-      memberships: [{workspaceId: crypto.randomUUID(), role: 'owner'}],
+      memberships: [{workspaceId: crypto.randomUUID(), role: 'owner', workspaceStatus: 'active'}],
     })
       .setProtectedHeader({alg: 'HS256'})
       .setSubject(crypto.randomUUID())

package/src/core/jwt.ts

@@ -1,4 +1,4 @@
-import {workspaceRoleSchema} from '@shipfox/api-workspaces-dto';
+import {workspaceRoleSchema, workspaceStatusSchema} from '@shipfox/api-workspaces-dto';
 import {signHs256, verifyHs256} from '@shipfox/node-jwt';
 import {z} from 'zod';
 import {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';
@@ -6,6 +6,7 @@ import {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';
 export const tokenMembershipSchema = z.object({
   workspaceId: z.string().uuid(),
   role: workspaceRoleSchema,
+  workspaceStatus: workspaceStatusSchema.default('active'),
 });
 
 export type TokenMembership = z.infer<typeof tokenMembershipSchema>;

package/src/core/runner-session-token.ts

@@ -30,7 +30,7 @@ export async function issueRunnerSessionToken(
   return token;
 }
 
-/** Returns the claims on success, or `null` for any invalid input — never throws. */
+/** Returns the claims on success, or `null` for any invalid input. Never throws. */
 export async function verifyRunnerSessionToken(
   token: string,
 ): Promise<RunnerSessionTokenClaims | null> {

package/src/db/rate-limits.ts

@@ -1,28 +1,23 @@
+import {
+  type ConsumeRateLimitParams,
+  type ConsumeRateLimitResult,
+  createRateLimitPersistence,
+} from '@shipfox/node-rate-limit';
 import {lt, sql} from 'drizzle-orm';
 import {db} from './db.js';
 import {authRateLimits} from './schema/rate-limits.js';
 
-export interface ConsumeAuthRateLimitParams {
-  action: string;
-  scope: string;
-  identifierHmac: string;
-  windowStart: Date;
-  expiresAt: Date;
-  timeoutMs: number;
-}
-
-export interface ConsumeAuthRateLimitResult {
-  count: number;
-  expiresAt: Date;
-}
-
-export async function consumeAuthRateLimit(
-  params: ConsumeAuthRateLimitParams,
-): Promise<ConsumeAuthRateLimitResult> {
-  return await db().transaction(async (tx) => {
-    await tx.execute(sql`select set_config('statement_timeout', ${`${params.timeoutMs}ms`}, true)`);
-
-    const rows = await tx
+type AuthRateLimitTransaction = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];
+
+const persistence = createRateLimitPersistence<AuthRateLimitTransaction>({
+  transaction: (callback) => db().transaction(callback),
+  setStatementTimeout: async (transaction, timeoutMs) => {
+    await transaction.execute(
+      sql`select set_config('statement_timeout', ${`${timeoutMs}ms`}, true)`,
+    );
+  },
+  consume: async (transaction, params) => {
+    const rows = await transaction
       .insert(authRateLimits)
       .values({
         action: params.action,
@@ -46,24 +41,15 @@ export async function consumeAuthRateLimit(
       })
       .returning({count: authRateLimits.count, expiresAt: authRateLimits.expiresAt});
 
-    const row = rows[0];
-    if (!row) throw new Error('Rate limit upsert returned no rows');
-    return row;
-  });
-}
-
-let nextPruneAt = 0;
-
-export async function pruneExpiredAuthRateLimits(
-  params: {now?: Date | undefined; minIntervalMs?: number | undefined} = {},
-): Promise<number | undefined> {
-  const now = params.now ?? new Date();
-  const minIntervalMs = params.minIntervalMs ?? 60_000;
-  if (minIntervalMs > 0 && now.getTime() < nextPruneAt) return undefined;
-
-  nextPruneAt = now.getTime() + minIntervalMs;
-
-  const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));
-
-  return result.rowCount ?? 0;
-}
+    return rows[0];
+  },
+  prune: async (now) => {
+    const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));
+    return result.rowCount ?? 0;
+  },
+});
+
+export type ConsumeAuthRateLimitParams = ConsumeRateLimitParams<string, string>;
+export type ConsumeAuthRateLimitResult = ConsumeRateLimitResult;
+export const consumeAuthRateLimit = persistence.consume;
+export const pruneExpiredAuthRateLimits = persistence.prune;

package/src/db/refresh-tokens.test.ts

@@ -1,7 +1,6 @@
 import {hashOpaqueToken} from '@shipfox/node-tokens';
 import {
   createRefreshToken,
-  findActiveRefreshSession,
   findActiveRefreshTokenByHash,
   findRefreshTokenByHash,
   revokeRefreshSession,
@@ -45,24 +44,6 @@ describe('refresh-tokens db', () => {
     expect(found).toBeUndefined();
   });
 
-  test('finds only the active session owned by the requested user', async () => {
-    const user = await createUser({email: emailFor('rt-session'), hashedPassword: 'h'});
-    const otherUser = await createUser({email: emailFor('rt-session-other'), hashedPassword: 'h'});
-    const sessionId = crypto.randomUUID();
-    await createRefreshToken({
-      userId: user.id,
-      sessionId,
-      hashedToken: hashOpaqueToken(`active-${crypto.randomUUID()}`),
-      expiresAt: new Date(Date.now() + 60_000),
-    });
-
-    const found = await findActiveRefreshSession({sessionId, userId: user.id});
-    const otherUserFound = await findActiveRefreshSession({sessionId, userId: otherUser.id});
-
-    expect(found?.sessionId).toBe(sessionId);
-    expect(otherUserFound).toBeUndefined();
-  });
-
   test('rotates a token once, creates the successor, and only the first caller wins', async () => {
     const user = await createUser({email: emailFor('rt-rotate'), hashedPassword: 'h'});
     const currentHashedToken = hashOpaqueToken(`current-${crypto.randomUUID()}`);

package/src/db/refresh-tokens.ts

@@ -61,7 +61,7 @@ export async function createRefreshTokenForActiveUser(
 }
 
 /**
- * Looks up the live session token by hash — one that can still authenticate as
+ * Looks up the live session token by hash. It can still authenticate as
  * the current session. Returns `undefined` for revoked, expired, or already
  * rotated tokens; rotated rows survive in the table only for the grace window
  * and are not "active".
@@ -87,34 +87,11 @@ export async function findActiveRefreshTokenByHash(params: {
   return toRefreshToken(row);
 }
 
-export async function findActiveRefreshSession(params: {
-  sessionId: string;
-  userId: string;
-}): Promise<RefreshToken | undefined> {
-  const rows = await db()
-    .select()
-    .from(refreshTokens)
-    .where(
-      and(
-        eq(refreshTokens.sessionId, params.sessionId),
-        eq(refreshTokens.userId, params.userId),
-        isNull(refreshTokens.revokedAt),
-        isNull(refreshTokens.rotatedAt),
-        gt(refreshTokens.expiresAt, sql`now()`),
-      ),
-    )
-    .limit(1);
-
-  const row = rows[0];
-  if (!row) return undefined;
-  return toRefreshToken(row);
-}
-
 /**
  * Looks up a non-revoked, non-expired token by hash, including ones already
  * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
- * rotate, honour the grace window, or reject reuse, so — unlike
- * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.
+ * rotate, honour the grace window, or reject reuse, so, unlike
+ * {@link findActiveRefreshTokenByHash}, it must still see rotated rows.
  */
 export async function findRefreshTokenByHash(params: {
   hashedToken: string;

package/src/presentation/auth/jwt-auth.test.ts

@@ -9,7 +9,7 @@ import {
   revokeRefreshTokenByHash,
   rotateRefreshToken,
 } from '#db/refresh-tokens.js';
-import {createUser, findUserById} from '#db/users.js';
+import {createUser} from '#db/users.js';
 import {createJwtAuthMethod, getAuthenticatedSessionContext, getClientContext} from './jwt-auth.js';
 
 const SECRET = userAccessTokenKey();
@@ -138,7 +138,35 @@ describe('jwt-auth', () => {
     expect(res.json().client.email).toBe(email);
   });
 
-  test('resolves the active refresh-session identity from an authenticated request', async () => {
+  test('verifies a token from claims when its user and refresh session are missing', async () => {
+    const userId = crypto.randomUUID();
+    const refreshSessionId = crypto.randomUUID();
+    const token = await signUserToken({
+      userId,
+      email: emailFor('jwt-missing-user'),
+      memberships: [],
+      refreshSessionId,
+      secret: SECRET,
+      expiresIn: '7d',
+    });
+
+    const protectedResponse = await app.inject({
+      method: 'GET',
+      url: '/protected',
+      headers: {authorization: `Bearer ${token}`},
+    });
+    const sessionResponse = await app.inject({
+      method: 'GET',
+      url: '/session',
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(protectedResponse.statusCode).toBe(200);
+    expect(sessionResponse.statusCode).toBe(200);
+    expect(sessionResponse.json()).toEqual({userId, refreshSessionId});
+  });
+
+  test('returns the refresh-session identity from an authenticated request', async () => {
     const user = await createUser({email: emailFor('jwt-session'), hashedPassword: 'h'});
     const rawRefreshToken = `refresh-${crypto.randomUUID()}`;
     const refreshToken = await createRefreshToken({
@@ -186,7 +214,7 @@ describe('jwt-auth', () => {
     expect(refreshed.json()).toEqual(initial.json());
   });
 
-  test('rejects an authenticated token after its refresh session is revoked', async () => {
+  test('keeps an authenticated token valid after its refresh session is revoked', async () => {
     const user = await createUser({email: emailFor('jwt-session-revoked'), hashedPassword: 'h'});
     const rawRefreshToken = `refresh-${crypto.randomUUID()}`;
     const refreshToken = await createRefreshToken({
@@ -210,7 +238,8 @@ describe('jwt-auth', () => {
       headers: {authorization: `Bearer ${token}`},
     });
 
-    expect(res.statusCode).toBe(401);
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({userId: user.id, refreshSessionId: refreshToken.sessionId});
   });
 
   test('rejects an authenticated token without a refresh-session claim', async () => {
@@ -231,8 +260,4 @@ describe('jwt-auth', () => {
 
     expect(res.statusCode).toBe(401);
   });
-
-  test('helpers remain available', () => {
-    expect(typeof findUserById).toBe('function');
-  });
 });

package/src/presentation/auth/jwt-auth.ts

@@ -12,8 +12,6 @@ import type {RefreshToken} from '#core/entities/refresh-token.js';
 import type {User} from '#core/entities/user.js';
 import type {UserTokenClaims} from '#core/jwt.js';
 import {verifyUserToken} from '#core/jwt.js';
-import {findActiveRefreshSession} from '#db/refresh-tokens.js';
-import {findUserById} from '#db/users.js';
 import {createBearerTokenAuthMethod} from './bearer-token-auth.js';
 
 const AUTHENTICATED_SESSION_CONTEXT_KEY = Symbol.for('@shipfox/api-auth/session');
@@ -61,10 +59,7 @@ function getAuthenticatedSessionTokenContext(request: FastifyRequest): {
   );
 }
 
-/**
- * Resolves the active refresh session backing an authenticated user request.
- * The session check intentionally happens only for consumers that need browser-session binding.
- */
+/** Returns the refresh-session metadata carried by a verified access token. */
 export async function getAuthenticatedSessionContext(
   request: FastifyRequest,
 ): Promise<AuthenticatedSessionContext> {
@@ -73,13 +68,7 @@ export async function getAuthenticatedSessionContext(
   if (!client || !token || token.userId !== client.userId || !token.refreshSessionId)
     throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});
 
-  const session = await findActiveRefreshSession({
-    sessionId: token.refreshSessionId,
-    userId: client.userId,
-  });
-  if (!session) throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});
-
-  return {userId: client.userId, refreshSessionId: session.sessionId};
+  return await Promise.resolve({userId: client.userId, refreshSessionId: token.refreshSessionId});
 }
 
 export function createJwtAuthMethod(): AuthMethod {
@@ -92,19 +81,7 @@ export function createJwtAuthMethod(): AuthMethod {
       } catch {
         throw new InvalidJwtTokenError();
       }
-      const user = await findUserById({id: claims.sub});
-
-      // Legacy access tokens without a session claim remain verifiable for the
-      // migration window; known suspended or deleted users are still rejected.
-      if (user && user.status !== 'active') return null;
-      if (!claims.refreshSessionId) return claims;
-      if (!user) return null;
-
-      const session = await findActiveRefreshSession({
-        sessionId: claims.refreshSessionId,
-        userId: claims.sub,
-      });
-      return session ? claims : null;
+      return claims;
     },
     isInvalidTokenError: (error) => error instanceof InvalidJwtTokenError,
     invalidTokenError: {message: 'Invalid or expired token', code: 'unauthorized'},

package/src/presentation/auth/lease-token-auth.ts

@@ -4,7 +4,7 @@ import {verifyJobLeaseToken} from '#core/job-lease-token.js';
 import {createBearerTokenAuthMethod} from './bearer-token-auth.js';
 
 /**
- * Trust boundary: the signed token is the sole authority — `claims.jobId` scopes
+ * Trust boundary: the signed token is the sole authority. `claims.jobId` scopes
  * every runner request to exactly one job. `workflowRunId`/`workflowRunAttemptId`/`workspaceId`
  * are carried for consumers but are NOT verified against the database here.
  *