@shipfox/api-auth 10.2.0 → 12.0.0

package/src/presentation/routes/administration.test.ts

@@ -723,7 +723,8 @@ describe('Auth administration routes', () => {
       headers: {authorization: `Bearer ${target.token}`},
     });
     const suspendedLogin = await login(app, {email: target.email, password: target.password});
-    expect(suspendedMe.statusCode).toBe(401);
+    expect(suspendedMe.statusCode).toBe(200);
+    expect(suspendedMe.json().user).toMatchObject({id: target.userId, status: 'suspended'});
     expect(suspendedLogin.statusCode).toBe(401);
 
     const suspendedDbUser = (
@@ -841,6 +842,13 @@ describe('Auth administration routes', () => {
     });
     expect(secondRefresh.statusCode).toBe(401);
 
+    const revokedAccess = await app.inject({
+      method: 'GET',
+      url: '/auth/me',
+      headers: {authorization: `Bearer ${newLogin.json().token}`},
+    });
+    expect(revokedAccess.statusCode).toBe(200);
+
     const repeatedRevoke = await app.inject({
       method: 'POST',
       url: `/admin/auth/users/${target.userId}/revoke-sessions`,

package/src/presentation/routes/password/change-password.test.ts

@@ -48,6 +48,11 @@ describe('POST /auth/change-password', () => {
       headers: {cookie: cookieHeader(account.refreshCookie)},
       payload: {},
     });
+    const access = await app.inject({
+      method: 'GET',
+      url: '/auth/me',
+      headers: {authorization: `Bearer ${account.token}`},
+    });
     const oldPasswordValid = await verifyPassword({
       password: account.password,
       hash: updatedUser?.hashedPassword ?? '',
@@ -62,6 +67,7 @@ describe('POST /auth/change-password', () => {
     expect(oldPasswordValid).toBe(false);
     expect(newPasswordValid).toBe(true);
     expect(refresh.statusCode).toBe(200);
+    expect(access.statusCode).toBe(200);
   });
 
   test('transforms invalid current password into 401', async () => {

package/src/presentation/routes/password/password-reset-confirm.test.ts

@@ -1,6 +1,7 @@
 import {AUTH_PASSWORD_RESET_SEND_REQUESTED} from '@shipfox/api-auth-dto';
 import type {FastifyInstance} from 'fastify';
 import {
+  cookieHeader,
   createAuthTestApp,
   extractToken,
   getSetCookie,
@@ -42,12 +43,25 @@ describe('POST /auth/password-reset/confirm', () => {
       payload: {token: resetToken, new_password: 'reset password is long'},
     });
     const loginRes = await login(app, {email: account.email, password: 'reset password is long'});
+    const oldRefresh = await app.inject({
+      method: 'POST',
+      url: '/auth/refresh',
+      headers: {cookie: cookieHeader(account.refreshCookie)},
+      payload: {},
+    });
+    const oldAccess = await app.inject({
+      method: 'GET',
+      url: '/auth/me',
+      headers: {authorization: `Bearer ${account.token}`},
+    });
 
     expect(confirm.statusCode).toBe(200);
     expect(confirm.json().token).toBeDefined();
     expect(confirm.json().user.email).toBe(account.email);
     expect(getSetCookie(confirm)).toContain('shipfox_refresh_token=');
     expect(loginRes.statusCode).toBe(200);
+    expect(oldRefresh.statusCode).toBe(401);
+    expect(oldAccess.statusCode).toBe(200);
   });
 
   test('transforms invalid token into 410', async () => {

package/src/presentation/routes/rate-limit.ts

@@ -1,10 +1,9 @@
 import {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';
+import {enforceRateLimit as enforceSharedRateLimit} from '@shipfox/node-rate-limit';
 import {
   type AuthRateLimitAction,
-  AuthRateLimitExceededError,
   type AuthRateLimitPolicy,
   type AuthRateLimitScope,
-  AuthRateLimitUnavailableError,
   checkAuthRateLimit,
 } from '#core/rate-limit.js';
 
@@ -49,68 +48,36 @@ async function enforceRateLimit(params: {
   const policy = policies[params.action][params.scope];
   if (!policy) return;
 
-  try {
-    await checkAuthRateLimit({
-      action: params.action,
-      scope: params.scope,
-      identifier: params.identifier,
-      ...policy,
-    });
-  } catch (error) {
-    if (error instanceof AuthRateLimitExceededError) {
-      params.request.log.warn(
-        {
-          action: error.action,
-          scope: error.scope,
-          route: routeName(params.request),
-          retryAfterSeconds: error.retryAfterSeconds,
-          identifierHmacPrefix: error.identifierHmacPrefix,
-        },
-        'Auth rate limit blocked request',
-      );
-      params.reply.header('Retry-After', String(error.retryAfterSeconds));
-      throw new ClientError('Rate limit exceeded', 'rate-limited', {
-        status: 429,
-        details: {retry_after_seconds: error.retryAfterSeconds},
-        data: {
-          action: error.action,
-          scope: error.scope,
-          route: routeName(params.request),
-          identifierHmacPrefix: error.identifierHmacPrefix,
-        },
-        cause: error,
-      });
-    }
-
-    if (error instanceof AuthRateLimitUnavailableError) {
-      params.request.log.error(
-        {
-          action: error.action,
-          scope: error.scope,
-          route: routeName(params.request),
-          identifierHmacPrefix: error.identifierHmacPrefix,
-          err: error,
-        },
-        'Auth rate limiter unavailable',
-      );
-      throw new ClientError(
-        'Authentication rate limiter unavailable',
-        'auth-rate-limit-unavailable',
-        {
-          status: 503,
-          data: {
-            action: error.action,
-            scope: error.scope,
-            route: routeName(params.request),
-            identifierHmacPrefix: error.identifierHmacPrefix,
-          },
-          cause: error,
-        },
-      );
-    }
-
-    throw error;
-  }
+  await enforceSharedRateLimit({
+    request: params.request,
+    reply: params.reply,
+    check: () =>
+      checkAuthRateLimit({
+        action: params.action,
+        scope: params.scope,
+        identifier: params.identifier,
+        ...policy,
+      }),
+    route: routeName(params.request),
+    unavailableCode: 'auth-rate-limit-unavailable',
+    unavailableMessage: 'Authentication rate limiter unavailable',
+    setRetryAfter: (reply, retryAfterSeconds) => {
+      reply.header('Retry-After', String(retryAfterSeconds));
+    },
+    logWarn: (request, context) => {
+      request.log.warn(context, 'Auth rate limit blocked request');
+    },
+    logError: (request, context) => {
+      request.log.error(context, 'Auth rate limiter unavailable');
+    },
+    createClientError: (presentation, cause) =>
+      new ClientError(presentation.message, presentation.code, {
+        status: presentation.status,
+        ...(presentation.details ? {details: presentation.details} : {}),
+        data: presentation.data,
+        cause,
+      }),
+  });
 }
 
 export function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {

package/src/presentation/routes/registration/signup.test.ts

@@ -165,7 +165,7 @@ describe('POST /auth/signup', () => {
       alreadyMember: false,
     }));
     listMembershipsByUserMock.mockResolvedValueOnce({
-      memberships: [{workspaceId, role: 'admin' as const}],
+      memberships: [{workspaceId, role: 'admin' as const, workspaceStatus: 'active'}],
     });
     const res = await app.inject({
       method: 'POST',
@@ -190,7 +190,7 @@ describe('POST /auth/signup', () => {
       workspace_id: workspaceId,
     });
     expect(body.accept_error).toBeUndefined();
-    expect(claims.memberships).toEqual([{workspaceId, role: 'admin'}]);
+    expect(claims.memberships).toEqual([{workspaceId, role: 'admin', workspaceStatus: 'active'}]);
     expect(capturedMail()).toHaveLength(0);
   });
 

package/src/presentation/routes/session/logout.test.ts

@@ -36,10 +36,16 @@ describe('POST /auth/logout', () => {
       headers: {cookie: cookieHeader(account.refreshCookie)},
       payload: {},
     });
+    const access = await app.inject({
+      method: 'GET',
+      url: '/auth/me',
+      headers: {authorization: `Bearer ${account.token}`},
+    });
 
     expect(res.statusCode).toBe(204);
     expect(res.headers['set-cookie']).toContain('shipfox_refresh_token=;');
     expect(refresh.statusCode).toBe(401);
+    expect(access.statusCode).toBe(200);
   });
 
   test('returns 204 when the refresh cookie is missing', async () => {

package/src/presentation/routes/session/refresh.test.ts

@@ -85,5 +85,16 @@ describe('POST /auth/refresh', () => {
 
     expect(res.statusCode).toBe(503);
     expect(res.json().code).toBe('auth-dependency-unavailable');
+    expect(res.headers['set-cookie']).toBeUndefined();
+
+    const retry = await app.inject({
+      method: 'POST',
+      url: '/auth/refresh',
+      headers: {cookie: cookieHeader(account.refreshCookie)},
+    });
+
+    expect(retry.statusCode).toBe(200);
+    expect(retry.json().token).toBeDefined();
+    expect(retry.headers['set-cookie']).toContain('shipfox_refresh_token=');
   });
 });