@shipfox/api-auth 11.0.0 → 12.0.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 67 files with swc (446.61ms)
+Successfully compiled: 67 files with swc (326.91ms)

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @shipfox/api-auth
 
+## 12.0.0
+
+### Patch Changes
+
+- f78740d: Remove Unicode dash punctuation from package prose and source comments.
+- 9ebc5b4: Add an authenticated, rate-limited workspace slug availability endpoint.
+- Updated dependencies [f78740d]
+- Updated dependencies [94aba88]
+- Updated dependencies [f13e8bb]
+- Updated dependencies [9ebc5b4]
+- Updated dependencies [34a5639]
+- Updated dependencies [e1efaee]
+  - @shipfox/api-auth-dto@12.0.0
+  - @shipfox/api-common-dto@12.0.0
+  - @shipfox/inter-module@0.2.3
+  - @shipfox/node-fastify@0.4.1
+  - @shipfox/node-module@1.0.5
+  - @shipfox/api-workspaces-dto@12.0.0
+  - @shipfox/node-jwt@0.4.0
+  - @shipfox/node-postgres@0.5.0
+  - @shipfox/node-rate-limit@0.4.0
+  - @shipfox/api-auth-context@12.0.0
+  - @shipfox/api-email-challenges@1.1.7
+  - @shipfox/node-drizzle@0.3.5
+  - @shipfox/node-outbox@0.2.6
+
 ## 11.0.0
 
 ### Major Changes

package/README.md

@@ -60,7 +60,7 @@ Required environment:
 | `AUTH_JOB_LEASE_TOKEN_EXPIRES_IN` | `90m` | Job lease token lifetime. |
 | `AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN` | `1h` | Runner session token lifetime. |
 | `AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS` | `14` | Refresh token and cookie lifetime. |
-| `AUTH_REFRESH_ROTATION_GRACE_SECONDS` | `30` | Grace window for accepting a just-rotated refresh token during concurrent refreshes. |
+| `AUTH_REFRESH_ROTATION_GRACE_SECONDS` | `30` | Grace window for accepting a recently rotated refresh token during concurrent refreshes. |
 | `AUTH_REFRESH_COOKIE_NAME` | `shipfox_refresh_token` | HTTP cookie name for refresh sessions. |
 | `AUTH_PASSWORD_ENABLED` | `true` | Enables password and email-verification routes. Set to `false` when another module provides login. Server construction fails if no login method is available. |
 | `AUTH_SIGNUP_GATE_ENABLED` | `false` | Restricts new account creation to the configured signup email allowlist. Requires `AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS` or `AUTH_SIGNUP_ALLOWED_EMAILS` to be set. |
@@ -116,16 +116,16 @@ itself.
 - **Audience:** signed-in users on first-party clients (web app, CLI).
 - **Grants:** the user's own account routes and, downstream, any route that
   authorizes against the membership claims. Its scope is "this user, with these
-  memberships" — never a single resource.
+  memberships", never a single resource.
 - **Lifecycle:**
-  - *Emit* — issued on login, signup verification, and password reset.
-  - *Exchange* — sent on each request; a longer-lived refresh session mints a
+  - *Emit*: issued on login, signup verification, and password reset.
+  - *Exchange*: sent on each request; a longer-lived refresh session mints a
     fresh token when it expires.
-  - *Store* — held in client memory only, never persisted to disk or local
+  - *Store*: held in client memory only, never persisted to disk or local
     storage. Refresh sessions are stored server-side as hashes, never in raw form.
-  - *Discard* — expires at the configured `exp` time. Revoking the refresh
+  - *Discard*: expires at the configured `exp` time. Revoking the refresh
     session blocks renewal but does not invalidate the issued access token.
-- **Tradeoff — stale memberships:** because memberships ride in the claims, a
+- **Tradeoff: stale memberships:** because memberships ride in the claims, a
   membership or workspace-status change only takes effect on the next token
   issuance or refresh. Accepted because the recommended lifetime is 15 minutes,
   so the staleness window is bounded and a per-request membership read is avoided.
@@ -137,7 +137,7 @@ The runner exchanges its long-lived registration token at startup, then uses the
 short-lived session token to claim jobs. Heartbeat and step/report/log operations
 use the per-job lease token instead.
 
-- **Scope — one workspace's runner data plane.** The token names one runner
+- **Scope: one workspace's runner data plane.** The token names one runner
   session, one workspace, the fixed `workspace` scope, and the session's immutable
   label set. It can claim jobs for that workspace. It is not a user identity and
   does not authorize dashboard management routes.
@@ -148,7 +148,7 @@ use the per-job lease token instead.
 - **Mechanics.** Signed with HMAC-SHA256 using the derived runner-session key
   and the `runner-session` audience. The default lifetime is `1h`, short enough
   to bound the residual claim window when a registration token is revoked.
-- **Tradeoff — no per-session revocation in v1.** Claim stays stateless and does
+- **Tradeoff: no per-session revocation in v1.** Claim stays stateless and does
   not check the runner session row on each poll. Revoking the registration token
   blocks new sessions, but an existing session can keep claiming until
   `AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN` elapses. A job execution claimed before
@@ -163,7 +163,7 @@ A single-job **capability** token, not a session. It is the means by which a
 runner proves it is the legitimate holder of one specific job while it reports
 progress and drives that job to completion.
 
-- **Scope — exactly one job execution.** The token authorizes action on the
+- **Scope: exactly one job execution.** The token authorizes action on the
   single job execution it names, for the runner holding it. It is **not** a runner
   identity, it is **not** workspace-wide, and it is **not** a substitute for the
   long-lived runner credential used to claim work in the first place. The
@@ -175,9 +175,9 @@ progress and drives that job to completion.
 - **Trust boundary.** There is exactly one issuer: the scheduling side mints a
   lease when a runner claims a job execution, next-step re-scopes it to the
   dispatched step attempt, and heartbeat re-mints the same narrow capability
-  after server state accepts the heartbeat. Everything
-  downstream only *verifies* — an in-process signature check, with no callback to
-  the issuer. The runner, and the untrusted agent workload it hosts, never mints
+  after server state accepts the heartbeat. Everything downstream only *verifies*
+  the token with an in-process signature check. It makes no callback to the
+  issuer. The runner, and the untrusted agent workload it hosts, never mints
   or modifies a token; it only presents the one it was handed.
 - **Mechanics.** Signed with HMAC-SHA256 using the job-lease key derived from
   `AUTH_ROOT_KEY`. Its claims name the job, job execution, and surrounding
@@ -187,13 +187,13 @@ progress and drives that job to completion.
   execution. The root key is supplied through configuration, never embedded in
   code or committed. The raw token must **never** be written to logs, traces, or
   error payloads. There is no automatic redaction to fall back on.
-- **Defense in depth — server state is the final authority.** A valid token is
+- **Defense in depth: server state is the final authority.** A valid token is
   never sufficient on its own to advance work. On the lease's own request path the
   gate is server-side step and progression state: a report against a step that has
   already reached a terminal state (finished, failed, or cancelled) is ignored, so
   a still-valid token cannot re-drive work that is already done. Job-level
   finalization is enforced outside the lease path. Cancellation flows the other way
-  as well — the server can ask the runner to stop at any point, and that request
+  as well: the server can ask the runner to stop at any point, and that request
   rides on the response to each heartbeat rather than depending on the token.
 - **Log append scope.** A step-scoped lease is a signed membership and attempt
   check for append-log authorization. It is not an active-step proof: until the
@@ -207,7 +207,7 @@ progress and drives that job to completion.
   other workspaces. If `AUTH_ROOT_KEY` leaks, rotate it. This invalidates every
   live token and email challenge derived from the old root, including every live
   lease, and forces fresh claims.
-- **Tradeoff — no per-token revocation.** A single outstanding lease cannot be
+- **Tradeoff: no per-token revocation.** A single outstanding lease cannot be
   revoked on its own by token ID. The claiming runner's credential is not
   re-checked on each request, so a lease for already-claimed work can continue to
   be renewed by heartbeat until server state cancels, completes, times out, or
@@ -217,7 +217,7 @@ progress and drives that job to completion.
 - **Guidelines for future changes.** Keep the authority narrow: do not add claims
   that grant access beyond the single job, keep the lifetime bounded, keep a single
   issuer, and keep every other side verify-only. If the no-revocation window ever
-  proves too wide, the right fix is to bind the lease to live runner or job state —
+  proves too wide, the right fix is to bind the lease to live runner or job state,
   not to broaden what the token itself can authorize.
 
 ## Routes
@@ -433,7 +433,7 @@ unauthorized` error when the verified request context is missing, inconsistent,
 or has no refresh-session ID. It exposes neither refresh-token material nor
 storage details.
 
-## Data Model
+## Data model
 
 The module creates tables with the `auth_` prefix:
 
@@ -446,7 +446,7 @@ The module creates tables with the `auth_` prefix:
 
 Passwords use Argon2id. Password reset tokens and refresh tokens are opaque tokens stored as hashes. Email verification uses the shared email-challenges module.
 
-## Behavior Notes
+## Behavior notes
 
 - Signup sends an eight-digit verification code and returns the new user with its challenge ID.
 - Signup gating blocks account creation only. Existing users keep signing in, even when their address is not on the current allowlist.

package/dist/core/job-lease-token.d.ts

@@ -6,7 +6,7 @@ export declare function jobLeaseParamsFrom(source: JobLeaseParamSource, stepScop
     currentStepAttempt: number;
 }): IssueJobLeaseTokenParams;
 export declare function issueJobLeaseToken(claims: IssueJobLeaseTokenParams): Promise<string>;
-/** Returns the claims on success, or `null` for any invalid input — never throws. */
+/** Returns the claims on success, or `null` for any invalid input. Never throws. */
 export declare function verifyJobLeaseToken(token: string): Promise<JobLeaseTokenClaims | null>;
 export {};
 //# sourceMappingURL=job-lease-token.d.ts.map

package/dist/core/job-lease-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-lease-token.d.ts","sourceRoot":"","sources":["../../src/core/job-lease-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,uBAAuB,CAAC;AAO/B,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,mBAAmB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAExF,KAAK,mBAAmB,GAAG,IAAI,CAC7B,mBAAmB,EACjB,eAAe,GACf,sBAAsB,GACtB,OAAO,GACP,gBAAgB,GAChB,WAAW,GACX,aAAa,GACb,iBAAiB,CACpB,CAAC;AAEF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,EAC3B,SAAS,CAAC,EAAE;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAC,GAC9D,wBAAwB,CAW1B;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B1F;AAED,qFAAqF;AACrF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAc5F"}
+{"version":3,"file":"job-lease-token.d.ts","sourceRoot":"","sources":["../../src/core/job-lease-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,uBAAuB,CAAC;AAO/B,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,mBAAmB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAExF,KAAK,mBAAmB,GAAG,IAAI,CAC7B,mBAAmB,EACjB,eAAe,GACf,sBAAsB,GACtB,OAAO,GACP,gBAAgB,GAChB,WAAW,GACX,aAAa,GACb,iBAAiB,CACpB,CAAC;AAEF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,EAC3B,SAAS,CAAC,EAAE;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAC,GAC9D,wBAAwB,CAW1B;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B1F;AAED,oFAAoF;AACpF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAc5F"}

package/dist/core/job-lease-token.js

@@ -40,7 +40,7 @@ export async function issueJobLeaseToken(claims) {
     recordTokenIssued('job_lease');
     return token;
 }
-/** Returns the claims on success, or `null` for any invalid input — never throws. */ export async function verifyJobLeaseToken(token) {
+/** Returns the claims on success, or `null` for any invalid input. Never throws. */ export async function verifyJobLeaseToken(token) {
     try {
         const claims = await verifyHs256({
             token,

package/dist/core/job-lease-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/job-lease-token.ts"],"sourcesContent":["import {\n  JOB_LEASE_TOKEN_AUDIENCE,\n  type JobLeaseTokenClaims,\n  jobLeaseTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueJobLeaseTokenParams = Omit<JobLeaseTokenClaims, 'aud' | 'iat' | 'exp'>;\n\ntype JobLeaseParamSource = Pick<\n  JobLeaseTokenClaims,\n  | 'workflowRunId'\n  | 'workflowRunAttemptId'\n  | 'jobId'\n  | 'jobExecutionId'\n  | 'projectId'\n  | 'workspaceId'\n  | 'runnerSessionId'\n>;\n\nexport function jobLeaseParamsFrom(\n  source: JobLeaseParamSource,\n  stepScope?: {currentStepId: string; currentStepAttempt: number},\n): IssueJobLeaseTokenParams {\n  return {\n    workflowRunId: source.workflowRunId,\n    workflowRunAttemptId: source.workflowRunAttemptId,\n    jobId: source.jobId,\n    jobExecutionId: source.jobExecutionId,\n    projectId: source.projectId,\n    workspaceId: source.workspaceId,\n    runnerSessionId: source.runnerSessionId,\n    ...(stepScope ? stepScope : {}),\n  };\n}\n\nexport async function issueJobLeaseToken(claims: IssueJobLeaseTokenParams): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      workflowRunId: claims.workflowRunId,\n      ...(claims.workflowRunAttempt === undefined\n        ? {}\n        : {workflowRunAttempt: claims.workflowRunAttempt}),\n      workflowRunAttemptId: claims.workflowRunAttemptId,\n      jobId: claims.jobId,\n      jobExecutionId: claims.jobExecutionId,\n      projectId: claims.projectId,\n      workspaceId: claims.workspaceId,\n      runnerSessionId: claims.runnerSessionId,\n      ...(claims.currentStepId && claims.currentStepAttempt !== undefined\n        ? {\n            currentStepId: claims.currentStepId,\n            currentStepAttempt: claims.currentStepAttempt,\n          }\n        : {}),\n    },\n    secret: jobLeaseTokenKey(),\n    expiresIn: config.AUTH_JOB_LEASE_TOKEN_EXPIRES_IN,\n    audience: JOB_LEASE_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('job_lease');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input — never throws. */\nexport async function verifyJobLeaseToken(token: string): Promise<JobLeaseTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: jobLeaseTokenKey(),\n      schema: jobLeaseTokenClaimsSchema,\n      audience: JOB_LEASE_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('job_lease', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('job_lease', 'rejected');\n    return null;\n  }\n}\n"],"names":["JOB_LEASE_TOKEN_AUDIENCE","jobLeaseTokenClaimsSchema","jobLeaseTokenKey","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","jobLeaseParamsFrom","source","stepScope","workflowRunId","workflowRunAttemptId","jobId","jobExecutionId","projectId","workspaceId","runnerSessionId","issueJobLeaseToken","claims","token","payload","workflowRunAttempt","undefined","currentStepId","currentStepAttempt","secret","expiresIn","AUTH_JOB_LEASE_TOKEN_EXPIRES_IN","audience","verifyJobLeaseToken","schema"],"mappings":"AAAA,SACEA,wBAAwB,EAExBC,yBAAyB,QACpB,wBAAwB;AAC/B,SAAQC,gBAAgB,QAAO,8BAA8B;AAC7D,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAgBzE,OAAO,SAASC,mBACdC,MAA2B,EAC3BC,SAA+D;IAE/D,OAAO;QACLC,eAAeF,OAAOE,aAAa;QACnCC,sBAAsBH,OAAOG,oBAAoB;QACjDC,OAAOJ,OAAOI,KAAK;QACnBC,gBAAgBL,OAAOK,cAAc;QACrCC,WAAWN,OAAOM,SAAS;QAC3BC,aAAaP,OAAOO,WAAW;QAC/BC,iBAAiBR,OAAOQ,eAAe;QACvC,GAAIP,YAAYA,YAAY,CAAC,CAAC;IAChC;AACF;AAEA,OAAO,eAAeQ,mBAAmBC,MAAgC;IACvE,MAAMC,QAAQ,MAAMjB,UAAU;QAC5BkB,SAAS;YACPV,eAAeQ,OAAOR,aAAa;YACnC,GAAIQ,OAAOG,kBAAkB,KAAKC,YAC9B,CAAC,IACD;gBAACD,oBAAoBH,OAAOG,kBAAkB;YAAA,CAAC;YACnDV,sBAAsBO,OAAOP,oBAAoB;YACjDC,OAAOM,OAAON,KAAK;YACnBC,gBAAgBK,OAAOL,cAAc;YACrCC,WAAWI,OAAOJ,SAAS;YAC3BC,aAAaG,OAAOH,WAAW;YAC/BC,iBAAiBE,OAAOF,eAAe;YACvC,GAAIE,OAAOK,aAAa,IAAIL,OAAOM,kBAAkB,KAAKF,YACtD;gBACEC,eAAeL,OAAOK,aAAa;gBACnCC,oBAAoBN,OAAOM,kBAAkB;YAC/C,IACA,CAAC,CAAC;QACR;QACAC,QAAQxB;QACRyB,WAAWtB,OAAOuB,+BAA+B;QACjDC,UAAU7B;IACZ;IACAM,kBAAkB;IAClB,OAAOc;AACT;AAEA,mFAAmF,GACnF,OAAO,eAAeU,oBAAoBV,KAAa;IACrD,IAAI;QACF,MAAMD,SAAS,MAAMf,YAAY;YAC/BgB;YACAM,QAAQxB;YACR6B,QAAQ9B;YACR4B,UAAU7B;QACZ;QACAO,oBAAoB,aAAa;QACjC,OAAOY;IACT,EAAE,OAAM;QACNZ,oBAAoB,aAAa;QACjC,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../src/core/job-lease-token.ts"],"sourcesContent":["import {\n  JOB_LEASE_TOKEN_AUDIENCE,\n  type JobLeaseTokenClaims,\n  jobLeaseTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueJobLeaseTokenParams = Omit<JobLeaseTokenClaims, 'aud' | 'iat' | 'exp'>;\n\ntype JobLeaseParamSource = Pick<\n  JobLeaseTokenClaims,\n  | 'workflowRunId'\n  | 'workflowRunAttemptId'\n  | 'jobId'\n  | 'jobExecutionId'\n  | 'projectId'\n  | 'workspaceId'\n  | 'runnerSessionId'\n>;\n\nexport function jobLeaseParamsFrom(\n  source: JobLeaseParamSource,\n  stepScope?: {currentStepId: string; currentStepAttempt: number},\n): IssueJobLeaseTokenParams {\n  return {\n    workflowRunId: source.workflowRunId,\n    workflowRunAttemptId: source.workflowRunAttemptId,\n    jobId: source.jobId,\n    jobExecutionId: source.jobExecutionId,\n    projectId: source.projectId,\n    workspaceId: source.workspaceId,\n    runnerSessionId: source.runnerSessionId,\n    ...(stepScope ? stepScope : {}),\n  };\n}\n\nexport async function issueJobLeaseToken(claims: IssueJobLeaseTokenParams): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      workflowRunId: claims.workflowRunId,\n      ...(claims.workflowRunAttempt === undefined\n        ? {}\n        : {workflowRunAttempt: claims.workflowRunAttempt}),\n      workflowRunAttemptId: claims.workflowRunAttemptId,\n      jobId: claims.jobId,\n      jobExecutionId: claims.jobExecutionId,\n      projectId: claims.projectId,\n      workspaceId: claims.workspaceId,\n      runnerSessionId: claims.runnerSessionId,\n      ...(claims.currentStepId && claims.currentStepAttempt !== undefined\n        ? {\n            currentStepId: claims.currentStepId,\n            currentStepAttempt: claims.currentStepAttempt,\n          }\n        : {}),\n    },\n    secret: jobLeaseTokenKey(),\n    expiresIn: config.AUTH_JOB_LEASE_TOKEN_EXPIRES_IN,\n    audience: JOB_LEASE_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('job_lease');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input. Never throws. */\nexport async function verifyJobLeaseToken(token: string): Promise<JobLeaseTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: jobLeaseTokenKey(),\n      schema: jobLeaseTokenClaimsSchema,\n      audience: JOB_LEASE_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('job_lease', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('job_lease', 'rejected');\n    return null;\n  }\n}\n"],"names":["JOB_LEASE_TOKEN_AUDIENCE","jobLeaseTokenClaimsSchema","jobLeaseTokenKey","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","jobLeaseParamsFrom","source","stepScope","workflowRunId","workflowRunAttemptId","jobId","jobExecutionId","projectId","workspaceId","runnerSessionId","issueJobLeaseToken","claims","token","payload","workflowRunAttempt","undefined","currentStepId","currentStepAttempt","secret","expiresIn","AUTH_JOB_LEASE_TOKEN_EXPIRES_IN","audience","verifyJobLeaseToken","schema"],"mappings":"AAAA,SACEA,wBAAwB,EAExBC,yBAAyB,QACpB,wBAAwB;AAC/B,SAAQC,gBAAgB,QAAO,8BAA8B;AAC7D,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAgBzE,OAAO,SAASC,mBACdC,MAA2B,EAC3BC,SAA+D;IAE/D,OAAO;QACLC,eAAeF,OAAOE,aAAa;QACnCC,sBAAsBH,OAAOG,oBAAoB;QACjDC,OAAOJ,OAAOI,KAAK;QACnBC,gBAAgBL,OAAOK,cAAc;QACrCC,WAAWN,OAAOM,SAAS;QAC3BC,aAAaP,OAAOO,WAAW;QAC/BC,iBAAiBR,OAAOQ,eAAe;QACvC,GAAIP,YAAYA,YAAY,CAAC,CAAC;IAChC;AACF;AAEA,OAAO,eAAeQ,mBAAmBC,MAAgC;IACvE,MAAMC,QAAQ,MAAMjB,UAAU;QAC5BkB,SAAS;YACPV,eAAeQ,OAAOR,aAAa;YACnC,GAAIQ,OAAOG,kBAAkB,KAAKC,YAC9B,CAAC,IACD;gBAACD,oBAAoBH,OAAOG,kBAAkB;YAAA,CAAC;YACnDV,sBAAsBO,OAAOP,oBAAoB;YACjDC,OAAOM,OAAON,KAAK;YACnBC,gBAAgBK,OAAOL,cAAc;YACrCC,WAAWI,OAAOJ,SAAS;YAC3BC,aAAaG,OAAOH,WAAW;YAC/BC,iBAAiBE,OAAOF,eAAe;YACvC,GAAIE,OAAOK,aAAa,IAAIL,OAAOM,kBAAkB,KAAKF,YACtD;gBACEC,eAAeL,OAAOK,aAAa;gBACnCC,oBAAoBN,OAAOM,kBAAkB;YAC/C,IACA,CAAC,CAAC;QACR;QACAC,QAAQxB;QACRyB,WAAWtB,OAAOuB,+BAA+B;QACjDC,UAAU7B;IACZ;IACAM,kBAAkB;IAClB,OAAOc;AACT;AAEA,kFAAkF,GAClF,OAAO,eAAeU,oBAAoBV,KAAa;IACrD,IAAI;QACF,MAAMD,SAAS,MAAMf,YAAY;YAC/BgB;YACAM,QAAQxB;YACR6B,QAAQ9B;YACR4B,UAAU7B;QACZ;QACAO,oBAAoB,aAAa;QACjC,OAAOY;IACT,EAAE,OAAM;QACNZ,oBAAoB,aAAa;QACjC,OAAO;IACT;AACF"}

package/dist/core/runner-session-token.d.ts

@@ -1,6 +1,6 @@
 import { type RunnerSessionTokenClaims } from '@shipfox/api-auth-dto';
 export type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;
 export declare function issueRunnerSessionToken(claims: IssueRunnerSessionTokenParams): Promise<string>;
-/** Returns the claims on success, or `null` for any invalid input — never throws. */
+/** Returns the claims on success, or `null` for any invalid input. Never throws. */
 export declare function verifyRunnerSessionToken(token: string): Promise<RunnerSessionTokenClaims | null>;
 //# sourceMappingURL=runner-session-token.d.ts.map

package/dist/core/runner-session-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner-session-token.d.ts","sourceRoot":"","sources":["../../src/core/runner-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,uBAAuB,CAAC;AAO/B,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAAC,wBAAwB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAElG,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qFAAqF;AACrF,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C"}
+{"version":3,"file":"runner-session-token.d.ts","sourceRoot":"","sources":["../../src/core/runner-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,uBAAuB,CAAC;AAO/B,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAAC,wBAAwB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAElG,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,oFAAoF;AACpF,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C"}

package/dist/core/runner-session-token.js

@@ -19,7 +19,7 @@ export async function issueRunnerSessionToken(claims) {
     recordTokenIssued('runner_session');
     return token;
 }
-/** Returns the claims on success, or `null` for any invalid input — never throws. */ export async function verifyRunnerSessionToken(token) {
+/** Returns the claims on success, or `null` for any invalid input. Never throws. */ export async function verifyRunnerSessionToken(token) {
     try {
         const claims = await verifyHs256({
             token,

package/dist/core/runner-session-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/runner-session-token.ts"],"sourcesContent":["import {\n  RUNNER_SESSION_TOKEN_AUDIENCE,\n  type RunnerSessionTokenClaims,\n  runnerSessionTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;\n\nexport async function issueRunnerSessionToken(\n  claims: IssueRunnerSessionTokenParams,\n): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      runnerSessionId: claims.runnerSessionId,\n      workspaceId: claims.workspaceId,\n      scope: claims.scope,\n      labels: claims.labels,\n      maxClaims: claims.maxClaims,\n    },\n    secret: runnerSessionTokenKey(),\n    expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,\n    audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('runner_session');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input — never throws. */\nexport async function verifyRunnerSessionToken(\n  token: string,\n): Promise<RunnerSessionTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: runnerSessionTokenKey(),\n      schema: runnerSessionTokenClaimsSchema,\n      audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('runner_session', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('runner_session', 'rejected');\n    return null;\n  }\n}\n"],"names":["RUNNER_SESSION_TOKEN_AUDIENCE","runnerSessionTokenClaimsSchema","runnerSessionTokenKey","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","issueRunnerSessionToken","claims","token","payload","runnerSessionId","workspaceId","scope","labels","maxClaims","secret","expiresIn","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","audience","verifyRunnerSessionToken","schema"],"mappings":"AAAA,SACEA,6BAA6B,EAE7BC,8BAA8B,QACzB,wBAAwB;AAC/B,SAAQC,qBAAqB,QAAO,8BAA8B;AAClE,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAKzE,OAAO,eAAeC,wBACpBC,MAAqC;IAErC,MAAMC,QAAQ,MAAMP,UAAU;QAC5BQ,SAAS;YACPC,iBAAiBH,OAAOG,eAAe;YACvCC,aAAaJ,OAAOI,WAAW;YAC/BC,OAAOL,OAAOK,KAAK;YACnBC,QAAQN,OAAOM,MAAM;YACrBC,WAAWP,OAAOO,SAAS;QAC7B;QACAC,QAAQf;QACRgB,WAAWb,OAAOc,oCAAoC;QACtDC,UAAUpB;IACZ;IACAM,kBAAkB;IAClB,OAAOI;AACT;AAEA,mFAAmF,GACnF,OAAO,eAAeW,yBACpBX,KAAa;IAEb,IAAI;QACF,MAAMD,SAAS,MAAML,YAAY;YAC/BM;YACAO,QAAQf;YACRoB,QAAQrB;YACRmB,UAAUpB;QACZ;QACAO,oBAAoB,kBAAkB;QACtC,OAAOE;IACT,EAAE,OAAM;QACNF,oBAAoB,kBAAkB;QACtC,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../src/core/runner-session-token.ts"],"sourcesContent":["import {\n  RUNNER_SESSION_TOKEN_AUDIENCE,\n  type RunnerSessionTokenClaims,\n  runnerSessionTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;\n\nexport async function issueRunnerSessionToken(\n  claims: IssueRunnerSessionTokenParams,\n): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      runnerSessionId: claims.runnerSessionId,\n      workspaceId: claims.workspaceId,\n      scope: claims.scope,\n      labels: claims.labels,\n      maxClaims: claims.maxClaims,\n    },\n    secret: runnerSessionTokenKey(),\n    expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,\n    audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('runner_session');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input. Never throws. */\nexport async function verifyRunnerSessionToken(\n  token: string,\n): Promise<RunnerSessionTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: runnerSessionTokenKey(),\n      schema: runnerSessionTokenClaimsSchema,\n      audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('runner_session', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('runner_session', 'rejected');\n    return null;\n  }\n}\n"],"names":["RUNNER_SESSION_TOKEN_AUDIENCE","runnerSessionTokenClaimsSchema","runnerSessionTokenKey","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","issueRunnerSessionToken","claims","token","payload","runnerSessionId","workspaceId","scope","labels","maxClaims","secret","expiresIn","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","audience","verifyRunnerSessionToken","schema"],"mappings":"AAAA,SACEA,6BAA6B,EAE7BC,8BAA8B,QACzB,wBAAwB;AAC/B,SAAQC,qBAAqB,QAAO,8BAA8B;AAClE,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAKzE,OAAO,eAAeC,wBACpBC,MAAqC;IAErC,MAAMC,QAAQ,MAAMP,UAAU;QAC5BQ,SAAS;YACPC,iBAAiBH,OAAOG,eAAe;YACvCC,aAAaJ,OAAOI,WAAW;YAC/BC,OAAOL,OAAOK,KAAK;YACnBC,QAAQN,OAAOM,MAAM;YACrBC,WAAWP,OAAOO,SAAS;QAC7B;QACAC,QAAQf;QACRgB,WAAWb,OAAOc,oCAAoC;QACtDC,UAAUpB;IACZ;IACAM,kBAAkB;IAClB,OAAOI;AACT;AAEA,kFAAkF,GAClF,OAAO,eAAeW,yBACpBX,KAAa;IAEb,IAAI;QACF,MAAMD,SAAS,MAAML,YAAY;YAC/BM;YACAO,QAAQf;YACRoB,QAAQrB;YACRmB,UAAUpB;QACZ;QACAO,oBAAoB,kBAAkB;QACtC,OAAOE;IACT,EAAE,OAAM;QACNF,oBAAoB,kBAAkB;QACtC,OAAO;IACT;AACF"}

package/dist/db/rate-limits.d.ts

@@ -1,18 +1,9 @@
-export interface ConsumeAuthRateLimitParams {
-    action: string;
-    scope: string;
-    identifierHmac: string;
-    windowStart: Date;
-    expiresAt: Date;
-    timeoutMs: number;
-}
-export interface ConsumeAuthRateLimitResult {
-    count: number;
-    expiresAt: Date;
-}
-export declare function consumeAuthRateLimit(params: ConsumeAuthRateLimitParams): Promise<ConsumeAuthRateLimitResult>;
-export declare function pruneExpiredAuthRateLimits(params?: {
+import { type ConsumeRateLimitParams, type ConsumeRateLimitResult } from '@shipfox/node-rate-limit';
+export type ConsumeAuthRateLimitParams = ConsumeRateLimitParams<string, string>;
+export type ConsumeAuthRateLimitResult = ConsumeRateLimitResult;
+export declare const consumeAuthRateLimit: (params: ConsumeRateLimitParams<string, string>) => Promise<ConsumeRateLimitResult>;
+export declare const pruneExpiredAuthRateLimits: (params?: {
     now?: Date | undefined;
     minIntervalMs?: number | undefined;
-}): Promise<number | undefined>;
+}) => Promise<number | undefined>;
 //# sourceMappingURL=rate-limits.d.ts.map

package/dist/db/rate-limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limits.d.ts","sourceRoot":"","sources":["../../src/db/rate-limits.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAgCrC;AAID,wBAAsB,0BAA0B,CAC9C,MAAM,GAAE;IAAC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAM,GACxE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B"}
+{"version":3,"file":"rate-limits.d.ts","sourceRoot":"","sources":["../../src/db/rate-limits.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAC;AA+ClC,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAChE,eAAO,MAAM,oBAAoB,qFAAsB,CAAC;AACxD,eAAO,MAAM,0BAA0B;;;iCAAoB,CAAC"}

package/dist/db/rate-limits.js

@@ -1,10 +1,14 @@
+import { createRateLimitPersistence } from '@shipfox/node-rate-limit';
 import { lt, sql } from 'drizzle-orm';
 import { db } from './db.js';
 import { authRateLimits } from './schema/rate-limits.js';
-export async function consumeAuthRateLimit(params) {
-    return await db().transaction(async (tx)=>{
-        await tx.execute(sql`select set_config('statement_timeout', ${`${params.timeoutMs}ms`}, true)`);
-        const rows = await tx.insert(authRateLimits).values({
+const persistence = createRateLimitPersistence({
+    transaction: (callback)=>db().transaction(callback),
+    setStatementTimeout: async (transaction, timeoutMs)=>{
+        await transaction.execute(sql`select set_config('statement_timeout', ${`${timeoutMs}ms`}, true)`);
+    },
+    consume: async (transaction, params)=>{
+        const rows = await transaction.insert(authRateLimits).values({
             action: params.action,
             scope: params.scope,
             identifierHmac: params.identifierHmac,
@@ -26,19 +30,14 @@ export async function consumeAuthRateLimit(params) {
             count: authRateLimits.count,
             expiresAt: authRateLimits.expiresAt
         });
-        const row = rows[0];
-        if (!row) throw new Error('Rate limit upsert returned no rows');
-        return row;
-    });
-}
-let nextPruneAt = 0;
-export async function pruneExpiredAuthRateLimits(params = {}) {
-    const now = params.now ?? new Date();
-    const minIntervalMs = params.minIntervalMs ?? 60_000;
-    if (minIntervalMs > 0 && now.getTime() < nextPruneAt) return undefined;
-    nextPruneAt = now.getTime() + minIntervalMs;
-    const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));
-    return result.rowCount ?? 0;
-}
+        return rows[0];
+    },
+    prune: async (now)=>{
+        const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));
+        return result.rowCount ?? 0;
+    }
+});
+export const consumeAuthRateLimit = persistence.consume;
+export const pruneExpiredAuthRateLimits = persistence.prune;
 
 //# sourceMappingURL=rate-limits.js.map

package/dist/db/rate-limits.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/rate-limits.ts"],"sourcesContent":["import {lt, sql} from 'drizzle-orm';\nimport {db} from './db.js';\nimport {authRateLimits} from './schema/rate-limits.js';\n\nexport interface ConsumeAuthRateLimitParams {\n  action: string;\n  scope: string;\n  identifierHmac: string;\n  windowStart: Date;\n  expiresAt: Date;\n  timeoutMs: number;\n}\n\nexport interface ConsumeAuthRateLimitResult {\n  count: number;\n  expiresAt: Date;\n}\n\nexport async function consumeAuthRateLimit(\n  params: ConsumeAuthRateLimitParams,\n): Promise<ConsumeAuthRateLimitResult> {\n  return await db().transaction(async (tx) => {\n    await tx.execute(sql`select set_config('statement_timeout', ${`${params.timeoutMs}ms`}, true)`);\n\n    const rows = await tx\n      .insert(authRateLimits)\n      .values({\n        action: params.action,\n        scope: params.scope,\n        identifierHmac: params.identifierHmac,\n        windowStart: params.windowStart,\n        count: 1,\n        expiresAt: params.expiresAt,\n      })\n      .onConflictDoUpdate({\n        target: [\n          authRateLimits.action,\n          authRateLimits.scope,\n          authRateLimits.identifierHmac,\n          authRateLimits.windowStart,\n        ],\n        set: {\n          count: sql`${authRateLimits.count} + 1`,\n          updatedAt: sql`now()`,\n        },\n      })\n      .returning({count: authRateLimits.count, expiresAt: authRateLimits.expiresAt});\n\n    const row = rows[0];\n    if (!row) throw new Error('Rate limit upsert returned no rows');\n    return row;\n  });\n}\n\nlet nextPruneAt = 0;\n\nexport async function pruneExpiredAuthRateLimits(\n  params: {now?: Date | undefined; minIntervalMs?: number | undefined} = {},\n): Promise<number | undefined> {\n  const now = params.now ?? new Date();\n  const minIntervalMs = params.minIntervalMs ?? 60_000;\n  if (minIntervalMs > 0 && now.getTime() < nextPruneAt) return undefined;\n\n  nextPruneAt = now.getTime() + minIntervalMs;\n\n  const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));\n\n  return result.rowCount ?? 0;\n}\n"],"names":["lt","sql","db","authRateLimits","consumeAuthRateLimit","params","transaction","tx","execute","timeoutMs","rows","insert","values","action","scope","identifierHmac","windowStart","count","expiresAt","onConflictDoUpdate","target","set","updatedAt","returning","row","Error","nextPruneAt","pruneExpiredAuthRateLimits","now","Date","minIntervalMs","getTime","undefined","result","delete","where","rowCount"],"mappings":"AAAA,SAAQA,EAAE,EAAEC,GAAG,QAAO,cAAc;AACpC,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,cAAc,QAAO,0BAA0B;AAgBvD,OAAO,eAAeC,qBACpBC,MAAkC;IAElC,OAAO,MAAMH,KAAKI,WAAW,CAAC,OAAOC;QACnC,MAAMA,GAAGC,OAAO,CAACP,GAAG,CAAC,uCAAuC,EAAE,GAAGI,OAAOI,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;QAE9F,MAAMC,OAAO,MAAMH,GAChBI,MAAM,CAACR,gBACPS,MAAM,CAAC;YACNC,QAAQR,OAAOQ,MAAM;YACrBC,OAAOT,OAAOS,KAAK;YACnBC,gBAAgBV,OAAOU,cAAc;YACrCC,aAAaX,OAAOW,WAAW;YAC/BC,OAAO;YACPC,WAAWb,OAAOa,SAAS;QAC7B,GACCC,kBAAkB,CAAC;YAClBC,QAAQ;gBACNjB,eAAeU,MAAM;gBACrBV,eAAeW,KAAK;gBACpBX,eAAeY,cAAc;gBAC7BZ,eAAea,WAAW;aAC3B;YACDK,KAAK;gBACHJ,OAAOhB,GAAG,CAAC,EAAEE,eAAec,KAAK,CAAC,IAAI,CAAC;gBACvCK,WAAWrB,GAAG,CAAC,KAAK,CAAC;YACvB;QACF,GACCsB,SAAS,CAAC;YAACN,OAAOd,eAAec,KAAK;YAAEC,WAAWf,eAAee,SAAS;QAAA;QAE9E,MAAMM,MAAMd,IAAI,CAAC,EAAE;QACnB,IAAI,CAACc,KAAK,MAAM,IAAIC,MAAM;QAC1B,OAAOD;IACT;AACF;AAEA,IAAIE,cAAc;AAElB,OAAO,eAAeC,2BACpBtB,SAAuE,CAAC,CAAC;IAEzE,MAAMuB,MAAMvB,OAAOuB,GAAG,IAAI,IAAIC;IAC9B,MAAMC,gBAAgBzB,OAAOyB,aAAa,IAAI;IAC9C,IAAIA,gBAAgB,KAAKF,IAAIG,OAAO,KAAKL,aAAa,OAAOM;IAE7DN,cAAcE,IAAIG,OAAO,KAAKD;IAE9B,MAAMG,SAAS,MAAM/B,KAAKgC,MAAM,CAAC/B,gBAAgBgC,KAAK,CAACnC,GAAGG,eAAee,SAAS,EAAEU;IAEpF,OAAOK,OAAOG,QAAQ,IAAI;AAC5B"}
+{"version":3,"sources":["../../src/db/rate-limits.ts"],"sourcesContent":["import {\n  type ConsumeRateLimitParams,\n  type ConsumeRateLimitResult,\n  createRateLimitPersistence,\n} from '@shipfox/node-rate-limit';\nimport {lt, sql} from 'drizzle-orm';\nimport {db} from './db.js';\nimport {authRateLimits} from './schema/rate-limits.js';\n\ntype AuthRateLimitTransaction = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];\n\nconst persistence = createRateLimitPersistence<AuthRateLimitTransaction>({\n  transaction: (callback) => db().transaction(callback),\n  setStatementTimeout: async (transaction, timeoutMs) => {\n    await transaction.execute(\n      sql`select set_config('statement_timeout', ${`${timeoutMs}ms`}, true)`,\n    );\n  },\n  consume: async (transaction, params) => {\n    const rows = await transaction\n      .insert(authRateLimits)\n      .values({\n        action: params.action,\n        scope: params.scope,\n        identifierHmac: params.identifierHmac,\n        windowStart: params.windowStart,\n        count: 1,\n        expiresAt: params.expiresAt,\n      })\n      .onConflictDoUpdate({\n        target: [\n          authRateLimits.action,\n          authRateLimits.scope,\n          authRateLimits.identifierHmac,\n          authRateLimits.windowStart,\n        ],\n        set: {\n          count: sql`${authRateLimits.count} + 1`,\n          updatedAt: sql`now()`,\n        },\n      })\n      .returning({count: authRateLimits.count, expiresAt: authRateLimits.expiresAt});\n\n    return rows[0];\n  },\n  prune: async (now) => {\n    const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));\n    return result.rowCount ?? 0;\n  },\n});\n\nexport type ConsumeAuthRateLimitParams = ConsumeRateLimitParams<string, string>;\nexport type ConsumeAuthRateLimitResult = ConsumeRateLimitResult;\nexport const consumeAuthRateLimit = persistence.consume;\nexport const pruneExpiredAuthRateLimits = persistence.prune;\n"],"names":["createRateLimitPersistence","lt","sql","db","authRateLimits","persistence","transaction","callback","setStatementTimeout","timeoutMs","execute","consume","params","rows","insert","values","action","scope","identifierHmac","windowStart","count","expiresAt","onConflictDoUpdate","target","set","updatedAt","returning","prune","now","result","delete","where","rowCount","consumeAuthRateLimit","pruneExpiredAuthRateLimits"],"mappings":"AAAA,SAGEA,0BAA0B,QACrB,2BAA2B;AAClC,SAAQC,EAAE,EAAEC,GAAG,QAAO,cAAc;AACpC,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,cAAc,QAAO,0BAA0B;AAIvD,MAAMC,cAAcL,2BAAqD;IACvEM,aAAa,CAACC,WAAaJ,KAAKG,WAAW,CAACC;IAC5CC,qBAAqB,OAAOF,aAAaG;QACvC,MAAMH,YAAYI,OAAO,CACvBR,GAAG,CAAC,uCAAuC,EAAE,GAAGO,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC;IAE1E;IACAE,SAAS,OAAOL,aAAaM;QAC3B,MAAMC,OAAO,MAAMP,YAChBQ,MAAM,CAACV,gBACPW,MAAM,CAAC;YACNC,QAAQJ,OAAOI,MAAM;YACrBC,OAAOL,OAAOK,KAAK;YACnBC,gBAAgBN,OAAOM,cAAc;YACrCC,aAAaP,OAAOO,WAAW;YAC/BC,OAAO;YACPC,WAAWT,OAAOS,SAAS;QAC7B,GACCC,kBAAkB,CAAC;YAClBC,QAAQ;gBACNnB,eAAeY,MAAM;gBACrBZ,eAAea,KAAK;gBACpBb,eAAec,cAAc;gBAC7Bd,eAAee,WAAW;aAC3B;YACDK,KAAK;gBACHJ,OAAOlB,GAAG,CAAC,EAAEE,eAAegB,KAAK,CAAC,IAAI,CAAC;gBACvCK,WAAWvB,GAAG,CAAC,KAAK,CAAC;YACvB;QACF,GACCwB,SAAS,CAAC;YAACN,OAAOhB,eAAegB,KAAK;YAAEC,WAAWjB,eAAeiB,SAAS;QAAA;QAE9E,OAAOR,IAAI,CAAC,EAAE;IAChB;IACAc,OAAO,OAAOC;QACZ,MAAMC,SAAS,MAAM1B,KAAK2B,MAAM,CAAC1B,gBAAgB2B,KAAK,CAAC9B,GAAGG,eAAeiB,SAAS,EAAEO;QACpF,OAAOC,OAAOG,QAAQ,IAAI;IAC5B;AACF;AAIA,OAAO,MAAMC,uBAAuB5B,YAAYM,OAAO,CAAC;AACxD,OAAO,MAAMuB,6BAA6B7B,YAAYsB,KAAK,CAAC"}

package/dist/db/refresh-tokens.d.ts

@@ -11,7 +11,7 @@ export interface CreateRefreshTokenParams {
 export declare function createRefreshToken(params: CreateRefreshTokenParams): Promise<RefreshToken>;
 export declare function createRefreshTokenForActiveUser(params: CreateRefreshTokenParams): Promise<RefreshToken | undefined>;
 /**
- * Looks up the live session token by hash — one that can still authenticate as
+ * Looks up the live session token by hash. It can still authenticate as
  * the current session. Returns `undefined` for revoked, expired, or already
  * rotated tokens; rotated rows survive in the table only for the grace window
  * and are not "active".
@@ -22,8 +22,8 @@ export declare function findActiveRefreshTokenByHash(params: {
 /**
  * Looks up a non-revoked, non-expired token by hash, including ones already
  * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
- * rotate, honour the grace window, or reject reuse, so — unlike
- * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.
+ * rotate, honour the grace window, or reject reuse, so, unlike
+ * {@link findActiveRefreshTokenByHash}, it must still see rotated rows.
  */
 export declare function findRefreshTokenByHash(params: {
     hashedToken: string;

package/dist/db/refresh-tokens.js

@@ -35,7 +35,7 @@ export async function createRefreshTokenForActiveUser(params) {
     });
 }
 /**
- * Looks up the live session token by hash — one that can still authenticate as
+ * Looks up the live session token by hash. It can still authenticate as
  * the current session. Returns `undefined` for revoked, expired, or already
  * rotated tokens; rotated rows survive in the table only for the grace window
  * and are not "active".
@@ -48,8 +48,8 @@ export async function createRefreshTokenForActiveUser(params) {
 /**
  * Looks up a non-revoked, non-expired token by hash, including ones already
  * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
- * rotate, honour the grace window, or reject reuse, so — unlike
- * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.
+ * rotate, honour the grace window, or reject reuse, so, unlike
+ * {@link findActiveRefreshTokenByHash}, it must still see rotated rows.
  */ export async function findRefreshTokenByHash(params) {
     const rows = await db().select().from(refreshTokens).where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt), gt(refreshTokens.expiresAt, sql`now()`))).limit(1);
     const row = rows[0];

package/dist/db/refresh-tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/refresh-tokens.ts"],"sourcesContent":["import {and, eq, gt, isNull, ne, sql} from 'drizzle-orm';\nimport type {RefreshToken} from '#core/entities/refresh-token.js';\nimport {db} from './db.js';\nimport {refreshTokens, toRefreshToken} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\ntype Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];\n\nexport async function lockUserSessionMutations(tx: Tx, userId: string): Promise<void> {\n  await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${`auth_user_sessions:${userId}`}))`);\n}\n\nexport interface CreateRefreshTokenParams {\n  sessionId?: string | undefined;\n  userId: string;\n  hashedToken: string;\n  expiresAt: Date;\n}\n\nexport async function createRefreshToken(params: CreateRefreshTokenParams): Promise<RefreshToken> {\n  const rows = await db()\n    .insert(refreshTokens)\n    .values({\n      sessionId: params.sessionId,\n      userId: params.userId,\n      hashedToken: params.hashedToken,\n      expiresAt: params.expiresAt,\n    })\n    .returning();\n\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toRefreshToken(row);\n}\n\nexport async function createRefreshTokenForActiveUser(\n  params: CreateRefreshTokenParams,\n): Promise<RefreshToken | undefined> {\n  return await db().transaction(async (tx) => {\n    await lockUserSessionMutations(tx, params.userId);\n    const userRows = await tx\n      .select({status: users.status})\n      .from(users)\n      .where(eq(users.id, params.userId))\n      .limit(1);\n    if (userRows[0]?.status !== 'active') return undefined;\n\n    const rows = await tx\n      .insert(refreshTokens)\n      .values({\n        sessionId: params.sessionId,\n        userId: params.userId,\n        hashedToken: params.hashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n    const row = rows[0];\n    if (!row) throw new Error('Insert returned no rows');\n    return toRefreshToken(row);\n  });\n}\n\n/**\n * Looks up the live session token by hash — one that can still authenticate as\n * the current session. Returns `undefined` for revoked, expired, or already\n * rotated tokens; rotated rows survive in the table only for the grace window\n * and are not \"active\".\n */\nexport async function findActiveRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        isNull(refreshTokens.rotatedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Looks up a non-revoked, non-expired token by hash, including ones already\n * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to\n * rotate, honour the grace window, or reject reuse, so — unlike\n * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.\n */\nexport async function findRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Atomically claims rotation and inserts the successor token. The predecessor is\n * marked rather than deleted so later reuse of the retired token can be detected.\n * If the successor insert fails, the predecessor rotation rolls back.\n */\nexport async function rotateRefreshToken(params: {\n  userId?: string | undefined;\n  id: string;\n  currentHashedToken: string;\n  nextHashedToken: string;\n  expiresAt: Date;\n}): Promise<RefreshToken | undefined> {\n  return await db().transaction(async (tx) => {\n    const userId =\n      params.userId ??\n      (\n        await tx\n          .select({userId: refreshTokens.userId})\n          .from(refreshTokens)\n          .where(eq(refreshTokens.id, params.id))\n          .limit(1)\n      )[0]?.userId;\n    if (!userId) return undefined;\n\n    await lockUserSessionMutations(tx, userId);\n    const userRows = await tx\n      .select({status: users.status})\n      .from(users)\n      .where(eq(users.id, userId))\n      .limit(1);\n    if (userRows[0]?.status !== 'active') return undefined;\n\n    const rotatedRows = await tx\n      .update(refreshTokens)\n      .set({\n        rotatedAt: sql`now()`,\n        lastUsedAt: sql`now()`,\n        updatedAt: sql`now()`,\n      })\n      .where(\n        and(\n          eq(refreshTokens.id, params.id),\n          eq(refreshTokens.hashedToken, params.currentHashedToken),\n          isNull(refreshTokens.revokedAt),\n          isNull(refreshTokens.rotatedAt),\n          gt(refreshTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .returning();\n\n    const rotated = rotatedRows[0];\n    if (!rotated) return undefined;\n\n    const successorRows = await tx\n      .insert(refreshTokens)\n      .values({\n        sessionId: rotated.sessionId,\n        userId: rotated.userId,\n        hashedToken: params.nextHashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n\n    if (!successorRows[0]) throw new Error('Insert returned no rows');\n\n    return toRefreshToken(rotated);\n  });\n}\n\nexport async function revokeRefreshTokenByHash(params: {hashedToken: string}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt)));\n}\n\nexport async function revokeRefreshSession(params: {\n  sessionId: string;\n  userId: string;\n}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.sessionId, params.sessionId),\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n      ),\n    );\n}\n\nexport async function revokeRefreshTokensForUser(params: {\n  userId: string;\n  exceptRefreshTokenId?: string | undefined;\n}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n        params.exceptRefreshTokenId ? ne(refreshTokens.id, params.exceptRefreshTokenId) : undefined,\n      ),\n    );\n}\n"],"names":["and","eq","gt","isNull","ne","sql","db","refreshTokens","toRefreshToken","users","lockUserSessionMutations","tx","userId","execute","createRefreshToken","params","rows","insert","values","sessionId","hashedToken","expiresAt","returning","row","Error","createRefreshTokenForActiveUser","transaction","userRows","select","status","from","where","id","limit","undefined","findActiveRefreshTokenByHash","revokedAt","rotatedAt","findRefreshTokenByHash","rotateRefreshToken","rotatedRows","update","set","lastUsedAt","updatedAt","currentHashedToken","rotated","successorRows","nextHashedToken","revokeRefreshTokenByHash","revokeRefreshSession","revokeRefreshTokensForUser","exceptRefreshTokenId"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,MAAM,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AAEzD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,aAAa,EAAEC,cAAc,QAAO,6BAA6B;AACzE,SAAQC,KAAK,QAAO,oBAAoB;AAIxC,OAAO,eAAeC,yBAAyBC,EAAM,EAAEC,MAAc;IACnE,MAAMD,GAAGE,OAAO,CAACR,GAAG,CAAC,sCAAsC,EAAE,CAAC,mBAAmB,EAAEO,QAAQ,CAAC,EAAE,CAAC;AACjG;AASA,OAAO,eAAeE,mBAAmBC,MAAgC;IACvE,MAAMC,OAAO,MAAMV,KAChBW,MAAM,CAACV,eACPW,MAAM,CAAC;QACNC,WAAWJ,OAAOI,SAAS;QAC3BP,QAAQG,OAAOH,MAAM;QACrBQ,aAAaL,OAAOK,WAAW;QAC/BC,WAAWN,OAAOM,SAAS;IAC7B,GACCC,SAAS;IAEZ,MAAMC,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOhB,eAAee;AACxB;AAEA,OAAO,eAAeE,gCACpBV,MAAgC;IAEhC,OAAO,MAAMT,KAAKoB,WAAW,CAAC,OAAOf;QACnC,MAAMD,yBAAyBC,IAAII,OAAOH,MAAM;QAChD,MAAMe,WAAW,MAAMhB,GACpBiB,MAAM,CAAC;YAACC,QAAQpB,MAAMoB,MAAM;QAAA,GAC5BC,IAAI,CAACrB,OACLsB,KAAK,CAAC9B,GAAGQ,MAAMuB,EAAE,EAAEjB,OAAOH,MAAM,GAChCqB,KAAK,CAAC;QACT,IAAIN,QAAQ,CAAC,EAAE,EAAEE,WAAW,UAAU,OAAOK;QAE7C,MAAMlB,OAAO,MAAML,GAChBM,MAAM,CAACV,eACPW,MAAM,CAAC;YACNC,WAAWJ,OAAOI,SAAS;YAC3BP,QAAQG,OAAOH,MAAM;YACrBQ,aAAaL,OAAOK,WAAW;YAC/BC,WAAWN,OAAOM,SAAS;QAC7B,GACCC,SAAS;QACZ,MAAMC,MAAMP,IAAI,CAAC,EAAE;QACnB,IAAI,CAACO,KAAK,MAAM,IAAIC,MAAM;QAC1B,OAAOhB,eAAee;IACxB;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeY,6BAA6BpB,MAElD;IACC,MAAMC,OAAO,MAAMV,KAChBsB,MAAM,GACNE,IAAI,CAACvB,eACLwB,KAAK,CACJ/B,IACEC,GAAGM,cAAca,WAAW,EAAEL,OAAOK,WAAW,GAChDjB,OAAOI,cAAc6B,SAAS,GAC9BjC,OAAOI,cAAc8B,SAAS,GAC9BnC,GAAGK,cAAcc,SAAS,EAAEhB,GAAG,CAAC,KAAK,CAAC,IAGzC4B,KAAK,CAAC;IAET,MAAMV,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,OAAOW;IACjB,OAAO1B,eAAee;AACxB;AAEA;;;;;CAKC,GACD,OAAO,eAAee,uBAAuBvB,MAE5C;IACC,MAAMC,OAAO,MAAMV,KAChBsB,MAAM,GACNE,IAAI,CAACvB,eACLwB,KAAK,CACJ/B,IACEC,GAAGM,cAAca,WAAW,EAAEL,OAAOK,WAAW,GAChDjB,OAAOI,cAAc6B,SAAS,GAC9BlC,GAAGK,cAAcc,SAAS,EAAEhB,GAAG,CAAC,KAAK,CAAC,IAGzC4B,KAAK,CAAC;IAET,MAAMV,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,OAAOW;IACjB,OAAO1B,eAAee;AACxB;AAEA;;;;CAIC,GACD,OAAO,eAAegB,mBAAmBxB,MAMxC;IACC,OAAO,MAAMT,KAAKoB,WAAW,CAAC,OAAOf;QACnC,MAAMC,SACJG,OAAOH,MAAM,IACb,AACE,CAAA,MAAMD,GACHiB,MAAM,CAAC;YAAChB,QAAQL,cAAcK,MAAM;QAAA,GACpCkB,IAAI,CAACvB,eACLwB,KAAK,CAAC9B,GAAGM,cAAcyB,EAAE,EAAEjB,OAAOiB,EAAE,GACpCC,KAAK,CAAC,EAAC,CACX,CAAC,EAAE,EAAErB;QACR,IAAI,CAACA,QAAQ,OAAOsB;QAEpB,MAAMxB,yBAAyBC,IAAIC;QACnC,MAAMe,WAAW,MAAMhB,GACpBiB,MAAM,CAAC;YAACC,QAAQpB,MAAMoB,MAAM;QAAA,GAC5BC,IAAI,CAACrB,OACLsB,KAAK,CAAC9B,GAAGQ,MAAMuB,EAAE,EAAEpB,SACnBqB,KAAK,CAAC;QACT,IAAIN,QAAQ,CAAC,EAAE,EAAEE,WAAW,UAAU,OAAOK;QAE7C,MAAMM,cAAc,MAAM7B,GACvB8B,MAAM,CAAClC,eACPmC,GAAG,CAAC;YACHL,WAAWhC,GAAG,CAAC,KAAK,CAAC;YACrBsC,YAAYtC,GAAG,CAAC,KAAK,CAAC;YACtBuC,WAAWvC,GAAG,CAAC,KAAK,CAAC;QACvB,GACC0B,KAAK,CACJ/B,IACEC,GAAGM,cAAcyB,EAAE,EAAEjB,OAAOiB,EAAE,GAC9B/B,GAAGM,cAAca,WAAW,EAAEL,OAAO8B,kBAAkB,GACvD1C,OAAOI,cAAc6B,SAAS,GAC9BjC,OAAOI,cAAc8B,SAAS,GAC9BnC,GAAGK,cAAcc,SAAS,EAAEhB,GAAG,CAAC,KAAK,CAAC,IAGzCiB,SAAS;QAEZ,MAAMwB,UAAUN,WAAW,CAAC,EAAE;QAC9B,IAAI,CAACM,SAAS,OAAOZ;QAErB,MAAMa,gBAAgB,MAAMpC,GACzBM,MAAM,CAACV,eACPW,MAAM,CAAC;YACNC,WAAW2B,QAAQ3B,SAAS;YAC5BP,QAAQkC,QAAQlC,MAAM;YACtBQ,aAAaL,OAAOiC,eAAe;YACnC3B,WAAWN,OAAOM,SAAS;QAC7B,GACCC,SAAS;QAEZ,IAAI,CAACyB,aAAa,CAAC,EAAE,EAAE,MAAM,IAAIvB,MAAM;QAEvC,OAAOhB,eAAesC;IACxB;AACF;AAEA,OAAO,eAAeG,yBAAyBlC,MAA6B;IAC1E,MAAMT,KACHmC,MAAM,CAAClC,eACPmC,GAAG,CAAC;QAACN,WAAW/B,GAAG,CAAC,KAAK,CAAC;QAAEuC,WAAWvC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjD0B,KAAK,CAAC/B,IAAIC,GAAGM,cAAca,WAAW,EAAEL,OAAOK,WAAW,GAAGjB,OAAOI,cAAc6B,SAAS;AAChG;AAEA,OAAO,eAAec,qBAAqBnC,MAG1C;IACC,MAAMT,KACHmC,MAAM,CAAClC,eACPmC,GAAG,CAAC;QAACN,WAAW/B,GAAG,CAAC,KAAK,CAAC;QAAEuC,WAAWvC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjD0B,KAAK,CACJ/B,IACEC,GAAGM,cAAcY,SAAS,EAAEJ,OAAOI,SAAS,GAC5ClB,GAAGM,cAAcK,MAAM,EAAEG,OAAOH,MAAM,GACtCT,OAAOI,cAAc6B,SAAS;AAGtC;AAEA,OAAO,eAAee,2BAA2BpC,MAGhD;IACC,MAAMT,KACHmC,MAAM,CAAClC,eACPmC,GAAG,CAAC;QAACN,WAAW/B,GAAG,CAAC,KAAK,CAAC;QAAEuC,WAAWvC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjD0B,KAAK,CACJ/B,IACEC,GAAGM,cAAcK,MAAM,EAAEG,OAAOH,MAAM,GACtCT,OAAOI,cAAc6B,SAAS,GAC9BrB,OAAOqC,oBAAoB,GAAGhD,GAAGG,cAAcyB,EAAE,EAAEjB,OAAOqC,oBAAoB,IAAIlB;AAG1F"}
+{"version":3,"sources":["../../src/db/refresh-tokens.ts"],"sourcesContent":["import {and, eq, gt, isNull, ne, sql} from 'drizzle-orm';\nimport type {RefreshToken} from '#core/entities/refresh-token.js';\nimport {db} from './db.js';\nimport {refreshTokens, toRefreshToken} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\ntype Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];\n\nexport async function lockUserSessionMutations(tx: Tx, userId: string): Promise<void> {\n  await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${`auth_user_sessions:${userId}`}))`);\n}\n\nexport interface CreateRefreshTokenParams {\n  sessionId?: string | undefined;\n  userId: string;\n  hashedToken: string;\n  expiresAt: Date;\n}\n\nexport async function createRefreshToken(params: CreateRefreshTokenParams): Promise<RefreshToken> {\n  const rows = await db()\n    .insert(refreshTokens)\n    .values({\n      sessionId: params.sessionId,\n      userId: params.userId,\n      hashedToken: params.hashedToken,\n      expiresAt: params.expiresAt,\n    })\n    .returning();\n\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toRefreshToken(row);\n}\n\nexport async function createRefreshTokenForActiveUser(\n  params: CreateRefreshTokenParams,\n): Promise<RefreshToken | undefined> {\n  return await db().transaction(async (tx) => {\n    await lockUserSessionMutations(tx, params.userId);\n    const userRows = await tx\n      .select({status: users.status})\n      .from(users)\n      .where(eq(users.id, params.userId))\n      .limit(1);\n    if (userRows[0]?.status !== 'active') return undefined;\n\n    const rows = await tx\n      .insert(refreshTokens)\n      .values({\n        sessionId: params.sessionId,\n        userId: params.userId,\n        hashedToken: params.hashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n    const row = rows[0];\n    if (!row) throw new Error('Insert returned no rows');\n    return toRefreshToken(row);\n  });\n}\n\n/**\n * Looks up the live session token by hash. It can still authenticate as\n * the current session. Returns `undefined` for revoked, expired, or already\n * rotated tokens; rotated rows survive in the table only for the grace window\n * and are not \"active\".\n */\nexport async function findActiveRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        isNull(refreshTokens.rotatedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Looks up a non-revoked, non-expired token by hash, including ones already\n * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to\n * rotate, honour the grace window, or reject reuse, so, unlike\n * {@link findActiveRefreshTokenByHash}, it must still see rotated rows.\n */\nexport async function findRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Atomically claims rotation and inserts the successor token. The predecessor is\n * marked rather than deleted so later reuse of the retired token can be detected.\n * If the successor insert fails, the predecessor rotation rolls back.\n */\nexport async function rotateRefreshToken(params: {\n  userId?: string | undefined;\n  id: string;\n  currentHashedToken: string;\n  nextHashedToken: string;\n  expiresAt: Date;\n}): Promise<RefreshToken | undefined> {\n  return await db().transaction(async (tx) => {\n    const userId =\n      params.userId ??\n      (\n        await tx\n          .select({userId: refreshTokens.userId})\n          .from(refreshTokens)\n          .where(eq(refreshTokens.id, params.id))\n          .limit(1)\n      )[0]?.userId;\n    if (!userId) return undefined;\n\n    await lockUserSessionMutations(tx, userId);\n    const userRows = await tx\n      .select({status: users.status})\n      .from(users)\n      .where(eq(users.id, userId))\n      .limit(1);\n    if (userRows[0]?.status !== 'active') return undefined;\n\n    const rotatedRows = await tx\n      .update(refreshTokens)\n      .set({\n        rotatedAt: sql`now()`,\n        lastUsedAt: sql`now()`,\n        updatedAt: sql`now()`,\n      })\n      .where(\n        and(\n          eq(refreshTokens.id, params.id),\n          eq(refreshTokens.hashedToken, params.currentHashedToken),\n          isNull(refreshTokens.revokedAt),\n          isNull(refreshTokens.rotatedAt),\n          gt(refreshTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .returning();\n\n    const rotated = rotatedRows[0];\n    if (!rotated) return undefined;\n\n    const successorRows = await tx\n      .insert(refreshTokens)\n      .values({\n        sessionId: rotated.sessionId,\n        userId: rotated.userId,\n        hashedToken: params.nextHashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n\n    if (!successorRows[0]) throw new Error('Insert returned no rows');\n\n    return toRefreshToken(rotated);\n  });\n}\n\nexport async function revokeRefreshTokenByHash(params: {hashedToken: string}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt)));\n}\n\nexport async function revokeRefreshSession(params: {\n  sessionId: string;\n  userId: string;\n}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.sessionId, params.sessionId),\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n      ),\n    );\n}\n\nexport async function revokeRefreshTokensForUser(params: {\n  userId: string;\n  exceptRefreshTokenId?: string | undefined;\n}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n        params.exceptRefreshTokenId ? ne(refreshTokens.id, params.exceptRefreshTokenId) : undefined,\n      ),\n    );\n}\n"],"names":["and","eq","gt","isNull","ne","sql","db","refreshTokens","toRefreshToken","users","lockUserSessionMutations","tx","userId","execute","createRefreshToken","params","rows","insert","values","sessionId","hashedToken","expiresAt","returning","row","Error","createRefreshTokenForActiveUser","transaction","userRows","select","status","from","where","id","limit","undefined","findActiveRefreshTokenByHash","revokedAt","rotatedAt","findRefreshTokenByHash","rotateRefreshToken","rotatedRows","update","set","lastUsedAt","updatedAt","currentHashedToken","rotated","successorRows","nextHashedToken","revokeRefreshTokenByHash","revokeRefreshSession","revokeRefreshTokensForUser","exceptRefreshTokenId"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,MAAM,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AAEzD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,aAAa,EAAEC,cAAc,QAAO,6BAA6B;AACzE,SAAQC,KAAK,QAAO,oBAAoB;AAIxC,OAAO,eAAeC,yBAAyBC,EAAM,EAAEC,MAAc;IACnE,MAAMD,GAAGE,OAAO,CAACR,GAAG,CAAC,sCAAsC,EAAE,CAAC,mBAAmB,EAAEO,QAAQ,CAAC,EAAE,CAAC;AACjG;AASA,OAAO,eAAeE,mBAAmBC,MAAgC;IACvE,MAAMC,OAAO,MAAMV,KAChBW,MAAM,CAACV,eACPW,MAAM,CAAC;QACNC,WAAWJ,OAAOI,SAAS;QAC3BP,QAAQG,OAAOH,MAAM;QACrBQ,aAAaL,OAAOK,WAAW;QAC/BC,WAAWN,OAAOM,SAAS;IAC7B,GACCC,SAAS;IAEZ,MAAMC,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOhB,eAAee;AACxB;AAEA,OAAO,eAAeE,gCACpBV,MAAgC;IAEhC,OAAO,MAAMT,KAAKoB,WAAW,CAAC,OAAOf;QACnC,MAAMD,yBAAyBC,IAAII,OAAOH,MAAM;QAChD,MAAMe,WAAW,MAAMhB,GACpBiB,MAAM,CAAC;YAACC,QAAQpB,MAAMoB,MAAM;QAAA,GAC5BC,IAAI,CAACrB,OACLsB,KAAK,CAAC9B,GAAGQ,MAAMuB,EAAE,EAAEjB,OAAOH,MAAM,GAChCqB,KAAK,CAAC;QACT,IAAIN,QAAQ,CAAC,EAAE,EAAEE,WAAW,UAAU,OAAOK;QAE7C,MAAMlB,OAAO,MAAML,GAChBM,MAAM,CAACV,eACPW,MAAM,CAAC;YACNC,WAAWJ,OAAOI,SAAS;YAC3BP,QAAQG,OAAOH,MAAM;YACrBQ,aAAaL,OAAOK,WAAW;YAC/BC,WAAWN,OAAOM,SAAS;QAC7B,GACCC,SAAS;QACZ,MAAMC,MAAMP,IAAI,CAAC,EAAE;QACnB,IAAI,CAACO,KAAK,MAAM,IAAIC,MAAM;QAC1B,OAAOhB,eAAee;IACxB;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeY,6BAA6BpB,MAElD;IACC,MAAMC,OAAO,MAAMV,KAChBsB,MAAM,GACNE,IAAI,CAACvB,eACLwB,KAAK,CACJ/B,IACEC,GAAGM,cAAca,WAAW,EAAEL,OAAOK,WAAW,GAChDjB,OAAOI,cAAc6B,SAAS,GAC9BjC,OAAOI,cAAc8B,SAAS,GAC9BnC,GAAGK,cAAcc,SAAS,EAAEhB,GAAG,CAAC,KAAK,CAAC,IAGzC4B,KAAK,CAAC;IAET,MAAMV,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,OAAOW;IACjB,OAAO1B,eAAee;AACxB;AAEA;;;;;CAKC,GACD,OAAO,eAAee,uBAAuBvB,MAE5C;IACC,MAAMC,OAAO,MAAMV,KAChBsB,MAAM,GACNE,IAAI,CAACvB,eACLwB,KAAK,CACJ/B,IACEC,GAAGM,cAAca,WAAW,EAAEL,OAAOK,WAAW,GAChDjB,OAAOI,cAAc6B,SAAS,GAC9BlC,GAAGK,cAAcc,SAAS,EAAEhB,GAAG,CAAC,KAAK,CAAC,IAGzC4B,KAAK,CAAC;IAET,MAAMV,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,OAAOW;IACjB,OAAO1B,eAAee;AACxB;AAEA;;;;CAIC,GACD,OAAO,eAAegB,mBAAmBxB,MAMxC;IACC,OAAO,MAAMT,KAAKoB,WAAW,CAAC,OAAOf;QACnC,MAAMC,SACJG,OAAOH,MAAM,IACb,AACE,CAAA,MAAMD,GACHiB,MAAM,CAAC;YAAChB,QAAQL,cAAcK,MAAM;QAAA,GACpCkB,IAAI,CAACvB,eACLwB,KAAK,CAAC9B,GAAGM,cAAcyB,EAAE,EAAEjB,OAAOiB,EAAE,GACpCC,KAAK,CAAC,EAAC,CACX,CAAC,EAAE,EAAErB;QACR,IAAI,CAACA,QAAQ,OAAOsB;QAEpB,MAAMxB,yBAAyBC,IAAIC;QACnC,MAAMe,WAAW,MAAMhB,GACpBiB,MAAM,CAAC;YAACC,QAAQpB,MAAMoB,MAAM;QAAA,GAC5BC,IAAI,CAACrB,OACLsB,KAAK,CAAC9B,GAAGQ,MAAMuB,EAAE,EAAEpB,SACnBqB,KAAK,CAAC;QACT,IAAIN,QAAQ,CAAC,EAAE,EAAEE,WAAW,UAAU,OAAOK;QAE7C,MAAMM,cAAc,MAAM7B,GACvB8B,MAAM,CAAClC,eACPmC,GAAG,CAAC;YACHL,WAAWhC,GAAG,CAAC,KAAK,CAAC;YACrBsC,YAAYtC,GAAG,CAAC,KAAK,CAAC;YACtBuC,WAAWvC,GAAG,CAAC,KAAK,CAAC;QACvB,GACC0B,KAAK,CACJ/B,IACEC,GAAGM,cAAcyB,EAAE,EAAEjB,OAAOiB,EAAE,GAC9B/B,GAAGM,cAAca,WAAW,EAAEL,OAAO8B,kBAAkB,GACvD1C,OAAOI,cAAc6B,SAAS,GAC9BjC,OAAOI,cAAc8B,SAAS,GAC9BnC,GAAGK,cAAcc,SAAS,EAAEhB,GAAG,CAAC,KAAK,CAAC,IAGzCiB,SAAS;QAEZ,MAAMwB,UAAUN,WAAW,CAAC,EAAE;QAC9B,IAAI,CAACM,SAAS,OAAOZ;QAErB,MAAMa,gBAAgB,MAAMpC,GACzBM,MAAM,CAACV,eACPW,MAAM,CAAC;YACNC,WAAW2B,QAAQ3B,SAAS;YAC5BP,QAAQkC,QAAQlC,MAAM;YACtBQ,aAAaL,OAAOiC,eAAe;YACnC3B,WAAWN,OAAOM,SAAS;QAC7B,GACCC,SAAS;QAEZ,IAAI,CAACyB,aAAa,CAAC,EAAE,EAAE,MAAM,IAAIvB,MAAM;QAEvC,OAAOhB,eAAesC;IACxB;AACF;AAEA,OAAO,eAAeG,yBAAyBlC,MAA6B;IAC1E,MAAMT,KACHmC,MAAM,CAAClC,eACPmC,GAAG,CAAC;QAACN,WAAW/B,GAAG,CAAC,KAAK,CAAC;QAAEuC,WAAWvC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjD0B,KAAK,CAAC/B,IAAIC,GAAGM,cAAca,WAAW,EAAEL,OAAOK,WAAW,GAAGjB,OAAOI,cAAc6B,SAAS;AAChG;AAEA,OAAO,eAAec,qBAAqBnC,MAG1C;IACC,MAAMT,KACHmC,MAAM,CAAClC,eACPmC,GAAG,CAAC;QAACN,WAAW/B,GAAG,CAAC,KAAK,CAAC;QAAEuC,WAAWvC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjD0B,KAAK,CACJ/B,IACEC,GAAGM,cAAcY,SAAS,EAAEJ,OAAOI,SAAS,GAC5ClB,GAAGM,cAAcK,MAAM,EAAEG,OAAOH,MAAM,GACtCT,OAAOI,cAAc6B,SAAS;AAGtC;AAEA,OAAO,eAAee,2BAA2BpC,MAGhD;IACC,MAAMT,KACHmC,MAAM,CAAClC,eACPmC,GAAG,CAAC;QAACN,WAAW/B,GAAG,CAAC,KAAK,CAAC;QAAEuC,WAAWvC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjD0B,KAAK,CACJ/B,IACEC,GAAGM,cAAcK,MAAM,EAAEG,OAAOH,MAAM,GACtCT,OAAOI,cAAc6B,SAAS,GAC9BrB,OAAOqC,oBAAoB,GAAGhD,GAAGG,cAAcyB,EAAE,EAAEjB,OAAOqC,oBAAoB,IAAIlB;AAG1F"}

package/dist/presentation/auth/lease-token-auth.d.ts

@@ -1,6 +1,6 @@
 import type { AuthMethod } from '@shipfox/node-fastify';
 /**
- * Trust boundary: the signed token is the sole authority — `claims.jobId` scopes
+ * Trust boundary: the signed token is the sole authority. `claims.jobId` scopes
  * every runner request to exactly one job. `workflowRunId`/`workflowRunAttemptId`/`workspaceId`
  * are carried for consumers but are NOT verified against the database here.
  *

package/dist/presentation/auth/lease-token-auth.js

@@ -2,7 +2,7 @@ import { AUTH_LEASED_JOB, setLeasedJobContext } from '@shipfox/api-auth-context'
 import { verifyJobLeaseToken } from '#core/job-lease-token.js';
 import { createBearerTokenAuthMethod } from './bearer-token-auth.js';
 /**
- * Trust boundary: the signed token is the sole authority — `claims.jobId` scopes
+ * Trust boundary: the signed token is the sole authority. `claims.jobId` scopes
  * every runner request to exactly one job. `workflowRunId`/`workflowRunAttemptId`/`workspaceId`
  * are carried for consumers but are NOT verified against the database here.
  *

package/dist/presentation/auth/lease-token-auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/auth/lease-token-auth.ts"],"sourcesContent":["import {AUTH_LEASED_JOB, setLeasedJobContext} from '@shipfox/api-auth-context';\nimport type {AuthMethod} from '@shipfox/node-fastify';\nimport {verifyJobLeaseToken} from '#core/job-lease-token.js';\nimport {createBearerTokenAuthMethod} from './bearer-token-auth.js';\n\n/**\n * Trust boundary: the signed token is the sole authority — `claims.jobId` scopes\n * every runner request to exactly one job. `workflowRunId`/`workflowRunAttemptId`/`workspaceId`\n * are carried for consumers but are NOT verified against the database here.\n *\n * Revocation tradeoff: `runnerSessionId` is carried in the claims but is not checked\n * against runner-session storage, so a lease minted before its registration token is\n * revoked stays usable until it expires (`AUTH_JOB_LEASE_TOKEN_EXPIRES_IN`, 90m).\n * Accepted deliberately for a short-lived, job-scoped capability token; tightening\n * this would mean a per-request DB lookup on the hot status-reporting path. See the\n * \"Security model\" section in the package README for the full rationale.\n */\nexport function createLeaseTokenAuthMethod(): AuthMethod {\n  return createBearerTokenAuthMethod({\n    name: AUTH_LEASED_JOB,\n    verifyToken: verifyJobLeaseToken,\n    invalidTokenError: {message: 'Invalid or expired job lease token', code: 'unauthorized'},\n    setContext: setLeasedJobContext,\n  });\n}\n"],"names":["AUTH_LEASED_JOB","setLeasedJobContext","verifyJobLeaseToken","createBearerTokenAuthMethod","createLeaseTokenAuthMethod","name","verifyToken","invalidTokenError","message","code","setContext"],"mappings":"AAAA,SAAQA,eAAe,EAAEC,mBAAmB,QAAO,4BAA4B;AAE/E,SAAQC,mBAAmB,QAAO,2BAA2B;AAC7D,SAAQC,2BAA2B,QAAO,yBAAyB;AAEnE;;;;;;;;;;;CAWC,GACD,OAAO,SAASC;IACd,OAAOD,4BAA4B;QACjCE,MAAML;QACNM,aAAaJ;QACbK,mBAAmB;YAACC,SAAS;YAAsCC,MAAM;QAAc;QACvFC,YAAYT;IACd;AACF"}
+{"version":3,"sources":["../../../src/presentation/auth/lease-token-auth.ts"],"sourcesContent":["import {AUTH_LEASED_JOB, setLeasedJobContext} from '@shipfox/api-auth-context';\nimport type {AuthMethod} from '@shipfox/node-fastify';\nimport {verifyJobLeaseToken} from '#core/job-lease-token.js';\nimport {createBearerTokenAuthMethod} from './bearer-token-auth.js';\n\n/**\n * Trust boundary: the signed token is the sole authority. `claims.jobId` scopes\n * every runner request to exactly one job. `workflowRunId`/`workflowRunAttemptId`/`workspaceId`\n * are carried for consumers but are NOT verified against the database here.\n *\n * Revocation tradeoff: `runnerSessionId` is carried in the claims but is not checked\n * against runner-session storage, so a lease minted before its registration token is\n * revoked stays usable until it expires (`AUTH_JOB_LEASE_TOKEN_EXPIRES_IN`, 90m).\n * Accepted deliberately for a short-lived, job-scoped capability token; tightening\n * this would mean a per-request DB lookup on the hot status-reporting path. See the\n * \"Security model\" section in the package README for the full rationale.\n */\nexport function createLeaseTokenAuthMethod(): AuthMethod {\n  return createBearerTokenAuthMethod({\n    name: AUTH_LEASED_JOB,\n    verifyToken: verifyJobLeaseToken,\n    invalidTokenError: {message: 'Invalid or expired job lease token', code: 'unauthorized'},\n    setContext: setLeasedJobContext,\n  });\n}\n"],"names":["AUTH_LEASED_JOB","setLeasedJobContext","verifyJobLeaseToken","createBearerTokenAuthMethod","createLeaseTokenAuthMethod","name","verifyToken","invalidTokenError","message","code","setContext"],"mappings":"AAAA,SAAQA,eAAe,EAAEC,mBAAmB,QAAO,4BAA4B;AAE/E,SAAQC,mBAAmB,QAAO,2BAA2B;AAC7D,SAAQC,2BAA2B,QAAO,yBAAyB;AAEnE;;;;;;;;;;;CAWC,GACD,OAAO,SAASC;IACd,OAAOD,4BAA4B;QACjCE,MAAML;QACNM,aAAaJ;QACbK,mBAAmB;YAACC,SAAS;YAAsCC,MAAM;QAAc;QACvFC,YAAYT;IACd;AACF"}

package/dist/presentation/routes/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACL,KAAK,mBAAmB,EAMzB,MAAM,qBAAqB,CAAC;AAyB7B,UAAU,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAgFD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,IACzD,SAAS,cAAc,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,CAAC,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,IAC3D,SAAS,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAS3E"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EACL,KAAK,mBAAmB,EAIzB,MAAM,qBAAqB,CAAC;AAyB7B,UAAU,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAgDD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,IACzD,SAAS,cAAc,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,CAAC,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,IAC3D,SAAS,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAS3E"}

package/dist/presentation/routes/rate-limit.js

@@ -1,5 +1,6 @@
 import { ClientError } from '@shipfox/node-fastify';
-import { AuthRateLimitExceededError, AuthRateLimitUnavailableError, checkAuthRateLimit } from '#core/rate-limit.js';
+import { enforceRateLimit as enforceSharedRateLimit } from '@shipfox/node-rate-limit';
+import { checkAuthRateLimit } from '#core/rate-limit.js';
 const policies = {
     login: {
         ip: {
@@ -46,58 +47,36 @@ function routeName(request) {
 async function enforceRateLimit(params) {
     const policy = policies[params.action][params.scope];
     if (!policy) return;
-    try {
-        await checkAuthRateLimit({
-            action: params.action,
-            scope: params.scope,
-            identifier: params.identifier,
-            ...policy
-        });
-    } catch (error) {
-        if (error instanceof AuthRateLimitExceededError) {
-            params.request.log.warn({
-                action: error.action,
-                scope: error.scope,
-                route: routeName(params.request),
-                retryAfterSeconds: error.retryAfterSeconds,
-                identifierHmacPrefix: error.identifierHmacPrefix
-            }, 'Auth rate limit blocked request');
-            params.reply.header('Retry-After', String(error.retryAfterSeconds));
-            throw new ClientError('Rate limit exceeded', 'rate-limited', {
-                status: 429,
-                details: {
-                    retry_after_seconds: error.retryAfterSeconds
-                },
-                data: {
-                    action: error.action,
-                    scope: error.scope,
-                    route: routeName(params.request),
-                    identifierHmacPrefix: error.identifierHmacPrefix
-                },
-                cause: error
-            });
-        }
-        if (error instanceof AuthRateLimitUnavailableError) {
-            params.request.log.error({
-                action: error.action,
-                scope: error.scope,
-                route: routeName(params.request),
-                identifierHmacPrefix: error.identifierHmacPrefix,
-                err: error
-            }, 'Auth rate limiter unavailable');
-            throw new ClientError('Authentication rate limiter unavailable', 'auth-rate-limit-unavailable', {
-                status: 503,
-                data: {
-                    action: error.action,
-                    scope: error.scope,
-                    route: routeName(params.request),
-                    identifierHmacPrefix: error.identifierHmacPrefix
-                },
-                cause: error
-            });
-        }
-        throw error;
-    }
+    await enforceSharedRateLimit({
+        request: params.request,
+        reply: params.reply,
+        check: ()=>checkAuthRateLimit({
+                action: params.action,
+                scope: params.scope,
+                identifier: params.identifier,
+                ...policy
+            }),
+        route: routeName(params.request),
+        unavailableCode: 'auth-rate-limit-unavailable',
+        unavailableMessage: 'Authentication rate limiter unavailable',
+        setRetryAfter: (reply, retryAfterSeconds)=>{
+            reply.header('Retry-After', String(retryAfterSeconds));
+        },
+        logWarn: (request, context)=>{
+            request.log.warn(context, 'Auth rate limit blocked request');
+        },
+        logError: (request, context)=>{
+            request.log.error(context, 'Auth rate limiter unavailable');
+        },
+        createClientError: (presentation, cause)=>new ClientError(presentation.message, presentation.code, {
+                status: presentation.status,
+                ...presentation.details ? {
+                    details: presentation.details
+                } : {},
+                data: presentation.data,
+                cause
+            })
+    });
 }
 export function createAuthRateLimitPreHandler(action) {
     return async (request, reply)=>{