@shipfox/api-auth 11.0.0 → 12.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-auth",
   "license": "MIT",
-  "version": "11.0.0",
+  "version": "12.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -26,24 +26,24 @@
     "@node-rs/argon2": "^2.0.2",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-common-dto": "9.2.0",
-    "@shipfox/api-auth-context": "11.0.0",
-    "@shipfox/api-auth-dto": "10.2.0",
-    "@shipfox/api-email-challenges": "1.1.6",
-    "@shipfox/api-workspaces-dto": "11.0.0",
-    "@shipfox/inter-module": "0.2.2",
+    "@shipfox/api-common-dto": "12.0.0",
+    "@shipfox/api-auth-context": "12.0.0",
+    "@shipfox/api-auth-dto": "12.0.0",
+    "@shipfox/api-email-challenges": "1.1.7",
+    "@shipfox/api-workspaces-dto": "12.0.0",
+    "@shipfox/inter-module": "0.2.3",
     "@shipfox/config": "1.2.4",
-    "@shipfox/node-drizzle": "0.3.4",
+    "@shipfox/node-drizzle": "0.3.5",
     "@shipfox/node-auth-root-key": "0.2.3",
-    "@shipfox/node-fastify": "0.4.0",
-    "@shipfox/node-jwt": "0.3.2",
+    "@shipfox/node-fastify": "0.4.1",
+    "@shipfox/node-jwt": "0.4.0",
     "@shipfox/node-email": "0.3.4",
     "@shipfox/node-mailer": "0.2.4",
-    "@shipfox/node-module": "1.0.4",
+    "@shipfox/node-module": "1.0.5",
     "@shipfox/node-opentelemetry": "0.6.3",
     "@shipfox/node-outbox": "0.2.6",
-    "@shipfox/node-postgres": "0.4.4",
-    "@shipfox/node-rate-limit": "0.3.2",
+    "@shipfox/node-postgres": "0.5.0",
+    "@shipfox/node-rate-limit": "0.4.0",
     "@shipfox/node-tokens": "0.3.2"
   },
   "imports": {

package/src/core/job-lease-token.ts

@@ -66,7 +66,7 @@ export async function issueJobLeaseToken(claims: IssueJobLeaseTokenParams): Prom
   return token;
 }
 
-/** Returns the claims on success, or `null` for any invalid input — never throws. */
+/** Returns the claims on success, or `null` for any invalid input. Never throws. */
 export async function verifyJobLeaseToken(token: string): Promise<JobLeaseTokenClaims | null> {
   try {
     const claims = await verifyHs256({

package/src/core/runner-session-token.ts

@@ -30,7 +30,7 @@ export async function issueRunnerSessionToken(
   return token;
 }
 
-/** Returns the claims on success, or `null` for any invalid input — never throws. */
+/** Returns the claims on success, or `null` for any invalid input. Never throws. */
 export async function verifyRunnerSessionToken(
   token: string,
 ): Promise<RunnerSessionTokenClaims | null> {

package/src/db/rate-limits.ts

@@ -1,28 +1,23 @@
+import {
+  type ConsumeRateLimitParams,
+  type ConsumeRateLimitResult,
+  createRateLimitPersistence,
+} from '@shipfox/node-rate-limit';
 import {lt, sql} from 'drizzle-orm';
 import {db} from './db.js';
 import {authRateLimits} from './schema/rate-limits.js';
 
-export interface ConsumeAuthRateLimitParams {
-  action: string;
-  scope: string;
-  identifierHmac: string;
-  windowStart: Date;
-  expiresAt: Date;
-  timeoutMs: number;
-}
-
-export interface ConsumeAuthRateLimitResult {
-  count: number;
-  expiresAt: Date;
-}
-
-export async function consumeAuthRateLimit(
-  params: ConsumeAuthRateLimitParams,
-): Promise<ConsumeAuthRateLimitResult> {
-  return await db().transaction(async (tx) => {
-    await tx.execute(sql`select set_config('statement_timeout', ${`${params.timeoutMs}ms`}, true)`);
-
-    const rows = await tx
+type AuthRateLimitTransaction = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];
+
+const persistence = createRateLimitPersistence<AuthRateLimitTransaction>({
+  transaction: (callback) => db().transaction(callback),
+  setStatementTimeout: async (transaction, timeoutMs) => {
+    await transaction.execute(
+      sql`select set_config('statement_timeout', ${`${timeoutMs}ms`}, true)`,
+    );
+  },
+  consume: async (transaction, params) => {
+    const rows = await transaction
       .insert(authRateLimits)
       .values({
         action: params.action,
@@ -46,24 +41,15 @@ export async function consumeAuthRateLimit(
       })
       .returning({count: authRateLimits.count, expiresAt: authRateLimits.expiresAt});
 
-    const row = rows[0];
-    if (!row) throw new Error('Rate limit upsert returned no rows');
-    return row;
-  });
-}
-
-let nextPruneAt = 0;
-
-export async function pruneExpiredAuthRateLimits(
-  params: {now?: Date | undefined; minIntervalMs?: number | undefined} = {},
-): Promise<number | undefined> {
-  const now = params.now ?? new Date();
-  const minIntervalMs = params.minIntervalMs ?? 60_000;
-  if (minIntervalMs > 0 && now.getTime() < nextPruneAt) return undefined;
-
-  nextPruneAt = now.getTime() + minIntervalMs;
-
-  const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));
-
-  return result.rowCount ?? 0;
-}
+    return rows[0];
+  },
+  prune: async (now) => {
+    const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));
+    return result.rowCount ?? 0;
+  },
+});
+
+export type ConsumeAuthRateLimitParams = ConsumeRateLimitParams<string, string>;
+export type ConsumeAuthRateLimitResult = ConsumeRateLimitResult;
+export const consumeAuthRateLimit = persistence.consume;
+export const pruneExpiredAuthRateLimits = persistence.prune;

package/src/db/refresh-tokens.ts

@@ -61,7 +61,7 @@ export async function createRefreshTokenForActiveUser(
 }
 
 /**
- * Looks up the live session token by hash — one that can still authenticate as
+ * Looks up the live session token by hash. It can still authenticate as
  * the current session. Returns `undefined` for revoked, expired, or already
  * rotated tokens; rotated rows survive in the table only for the grace window
  * and are not "active".
@@ -90,8 +90,8 @@ export async function findActiveRefreshTokenByHash(params: {
 /**
  * Looks up a non-revoked, non-expired token by hash, including ones already
  * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
- * rotate, honour the grace window, or reject reuse, so — unlike
- * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.
+ * rotate, honour the grace window, or reject reuse, so, unlike
+ * {@link findActiveRefreshTokenByHash}, it must still see rotated rows.
  */
 export async function findRefreshTokenByHash(params: {
   hashedToken: string;

package/src/presentation/auth/lease-token-auth.ts

@@ -4,7 +4,7 @@ import {verifyJobLeaseToken} from '#core/job-lease-token.js';
 import {createBearerTokenAuthMethod} from './bearer-token-auth.js';
 
 /**
- * Trust boundary: the signed token is the sole authority — `claims.jobId` scopes
+ * Trust boundary: the signed token is the sole authority. `claims.jobId` scopes
  * every runner request to exactly one job. `workflowRunId`/`workflowRunAttemptId`/`workspaceId`
  * are carried for consumers but are NOT verified against the database here.
  *

package/src/presentation/routes/rate-limit.ts

@@ -1,10 +1,9 @@
 import {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';
+import {enforceRateLimit as enforceSharedRateLimit} from '@shipfox/node-rate-limit';
 import {
   type AuthRateLimitAction,
-  AuthRateLimitExceededError,
   type AuthRateLimitPolicy,
   type AuthRateLimitScope,
-  AuthRateLimitUnavailableError,
   checkAuthRateLimit,
 } from '#core/rate-limit.js';
 
@@ -49,68 +48,36 @@ async function enforceRateLimit(params: {
   const policy = policies[params.action][params.scope];
   if (!policy) return;
 
-  try {
-    await checkAuthRateLimit({
-      action: params.action,
-      scope: params.scope,
-      identifier: params.identifier,
-      ...policy,
-    });
-  } catch (error) {
-    if (error instanceof AuthRateLimitExceededError) {
-      params.request.log.warn(
-        {
-          action: error.action,
-          scope: error.scope,
-          route: routeName(params.request),
-          retryAfterSeconds: error.retryAfterSeconds,
-          identifierHmacPrefix: error.identifierHmacPrefix,
-        },
-        'Auth rate limit blocked request',
-      );
-      params.reply.header('Retry-After', String(error.retryAfterSeconds));
-      throw new ClientError('Rate limit exceeded', 'rate-limited', {
-        status: 429,
-        details: {retry_after_seconds: error.retryAfterSeconds},
-        data: {
-          action: error.action,
-          scope: error.scope,
-          route: routeName(params.request),
-          identifierHmacPrefix: error.identifierHmacPrefix,
-        },
-        cause: error,
-      });
-    }
-
-    if (error instanceof AuthRateLimitUnavailableError) {
-      params.request.log.error(
-        {
-          action: error.action,
-          scope: error.scope,
-          route: routeName(params.request),
-          identifierHmacPrefix: error.identifierHmacPrefix,
-          err: error,
-        },
-        'Auth rate limiter unavailable',
-      );
-      throw new ClientError(
-        'Authentication rate limiter unavailable',
-        'auth-rate-limit-unavailable',
-        {
-          status: 503,
-          data: {
-            action: error.action,
-            scope: error.scope,
-            route: routeName(params.request),
-            identifierHmacPrefix: error.identifierHmacPrefix,
-          },
-          cause: error,
-        },
-      );
-    }
-
-    throw error;
-  }
+  await enforceSharedRateLimit({
+    request: params.request,
+    reply: params.reply,
+    check: () =>
+      checkAuthRateLimit({
+        action: params.action,
+        scope: params.scope,
+        identifier: params.identifier,
+        ...policy,
+      }),
+    route: routeName(params.request),
+    unavailableCode: 'auth-rate-limit-unavailable',
+    unavailableMessage: 'Authentication rate limiter unavailable',
+    setRetryAfter: (reply, retryAfterSeconds) => {
+      reply.header('Retry-After', String(retryAfterSeconds));
+    },
+    logWarn: (request, context) => {
+      request.log.warn(context, 'Auth rate limit blocked request');
+    },
+    logError: (request, context) => {
+      request.log.error(context, 'Auth rate limiter unavailable');
+    },
+    createClientError: (presentation, cause) =>
+      new ClientError(presentation.message, presentation.code, {
+        status: presentation.status,
+        ...(presentation.details ? {details: presentation.details} : {}),
+        data: presentation.data,
+        cause,
+      }),
+  });
 }
 
 export function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {