@shipfox/api-auth 12.0.0 → 13.1.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-auth",
   "license": "MIT",
-  "version": "12.0.0",
+  "version": "13.1.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -27,20 +27,20 @@
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
     "@shipfox/api-common-dto": "12.0.0",
-    "@shipfox/api-auth-context": "12.0.0",
+    "@shipfox/api-auth-context": "12.2.0",
     "@shipfox/api-auth-dto": "12.0.0",
-    "@shipfox/api-email-challenges": "1.1.7",
+    "@shipfox/api-email-challenges": "1.1.9",
     "@shipfox/api-workspaces-dto": "12.0.0",
     "@shipfox/inter-module": "0.2.3",
     "@shipfox/config": "1.2.4",
     "@shipfox/node-drizzle": "0.3.5",
     "@shipfox/node-auth-root-key": "0.2.3",
-    "@shipfox/node-fastify": "0.4.1",
+    "@shipfox/node-fastify": "0.4.2",
     "@shipfox/node-jwt": "0.4.0",
-    "@shipfox/node-email": "0.3.4",
-    "@shipfox/node-mailer": "0.2.4",
-    "@shipfox/node-module": "1.0.5",
-    "@shipfox/node-opentelemetry": "0.6.3",
+    "@shipfox/node-email": "0.3.5",
+    "@shipfox/node-mailer": "0.2.5",
+    "@shipfox/node-module": "1.0.6",
+    "@shipfox/node-opentelemetry": "0.6.4",
     "@shipfox/node-outbox": "0.2.6",
     "@shipfox/node-postgres": "0.5.0",
     "@shipfox/node-rate-limit": "0.4.0",

package/src/config.test.ts

@@ -36,4 +36,16 @@ describe('signup gate configuration', () => {
     expect(config.AUTH_SIGNUP_GATE_ENABLED).toBe(true);
     expect(config.AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS).toBe('shipfox.io');
   });
+
+  test('rejects a Markdown denial message that exceeds the response limit', async () => {
+    vi.stubEnv(
+      'AUTH_SIGNUP_NOT_ALLOWED_MESSAGE',
+      `${'x'.repeat(499)}[Request access](https://example.test/access)`,
+    );
+    vi.resetModules();
+
+    await expect(import('#config.js')).rejects.toThrow(
+      'AUTH_SIGNUP_NOT_ALLOWED_MESSAGE must contain at most 500 characters',
+    );
+  });
 });

package/src/config.ts

@@ -1,4 +1,5 @@
 import {bool, createConfig, num, str} from '@shipfox/config';
+import {SIGNUP_DENIAL_MESSAGE_MAX_LENGTH} from '#core/ports.js';
 
 export const config = createConfig({
   ADMIN_BOOTSTRAP_TOKEN: str({
@@ -46,7 +47,7 @@ export const config = createConfig({
     default: '',
   }),
   AUTH_SIGNUP_NOT_ALLOWED_MESSAGE: str({
-    desc: 'Description returned when the signup gate blocks an account. Optional. The default is This Shipfox deployment does not accept new accounts right now.',
+    desc: 'Markdown message returned when the signup gate blocks an account. Use at most 500 characters. Optional. The default is This Shipfox deployment does not accept new accounts right now.',
     default: undefined,
   }),
   CLIENT_BASE_URL: str({
@@ -65,6 +66,15 @@ if (
   );
 }
 
+if (
+  config.AUTH_SIGNUP_NOT_ALLOWED_MESSAGE !== undefined &&
+  config.AUTH_SIGNUP_NOT_ALLOWED_MESSAGE.length > SIGNUP_DENIAL_MESSAGE_MAX_LENGTH
+) {
+  throw new Error(
+    `AUTH_SIGNUP_NOT_ALLOWED_MESSAGE must contain at most ${SIGNUP_DENIAL_MESSAGE_MAX_LENGTH} characters.`,
+  );
+}
+
 function hasSignupAllowlistEntry(value: string): boolean {
   return value.split(',').some((entry) => entry.trim().length > 0);
 }

package/src/core/auth-default-signup-policy.test.ts

@@ -28,6 +28,7 @@ describe('low-level account creation defaults', () => {
 
     await expect(signup({email, password: 'correct horse battery staple'})).rejects.toMatchObject({
       name: 'SignupNotAllowedError',
+      format: 'markdown',
     });
   });
 
@@ -44,6 +45,7 @@ describe('low-level account creation defaults', () => {
 
     await expect(provisionUser({email})).rejects.toMatchObject({
       name: 'SignupNotAllowedError',
+      format: 'markdown',
     });
   });
 

package/src/core/auth.test.ts

@@ -202,6 +202,7 @@ describe('auth core', () => {
       expect.objectContaining({
         name: 'SignupNotAllowedError',
         message: 'This Shipfox deployment does not accept new accounts right now.',
+        format: undefined,
       }),
     );
     expect(await findUserByEmail({email})).toBeUndefined();

package/src/core/auth.ts

@@ -71,7 +71,10 @@ async function assertSignupAllowed(params: {
   });
 
   if (!result.allowed) {
-    throw new SignupNotAllowedError(result.message ?? DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE);
+    throw new SignupNotAllowedError(
+      result.message ?? DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,
+      result.format,
+    );
   }
 }
 

package/src/core/errors.ts

@@ -1,3 +1,5 @@
+import type {SignupDenialMessageFormat} from './ports.js';
+
 export class WorkspaceNotFoundError extends Error {
   constructor(workspaceId: string) {
     super(`Workspace not found: ${workspaceId}`);
@@ -48,7 +50,10 @@ export class EmailTakenError extends Error {
 }
 
 export class SignupNotAllowedError extends Error {
-  constructor(message: string) {
+  constructor(
+    message: string,
+    readonly format?: SignupDenialMessageFormat,
+  ) {
     super(message);
     this.name = 'SignupNotAllowedError';
   }

package/src/core/ports.ts

@@ -1,7 +1,12 @@
+export const SIGNUP_DENIAL_MESSAGE_MAX_LENGTH = 500;
+export type SignupDenialMessageFormat = 'markdown';
+
 export interface SignupPolicy {
   isSignupAllowed(params: {
     email: string;
     emailVerified: boolean;
     source: string;
-  }): Promise<{allowed: true} | {allowed: false; message?: string}>;
+  }): Promise<
+    {allowed: true} | {allowed: false; message?: string; format?: SignupDenialMessageFormat}
+  >;
 }

package/src/core/signup-policy.test.ts

@@ -47,7 +47,11 @@ describe('createEnvironmentSignupPolicy', () => {
         emailVerified: true,
         source: 'oauth-google',
       }),
-    ).resolves.toEqual({allowed: false, message: DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE});
+    ).resolves.toEqual({
+      allowed: false,
+      message: DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,
+      format: 'markdown',
+    });
   });
 
   test('returns the configured denial message for an unmatched address', async () => {
@@ -60,7 +64,11 @@ describe('createEnvironmentSignupPolicy', () => {
         emailVerified: true,
         source: 'oauth-google',
       }),
-    ).resolves.toEqual({allowed: false, message: 'Ask your administrator for access.'});
+    ).resolves.toEqual({
+      allowed: false,
+      message: 'Ask your administrator for access.',
+      format: 'markdown',
+    });
   });
 
   test('allows every address when the gate is disabled', async () => {

package/src/core/signup-policy.ts

@@ -28,6 +28,7 @@ export function createEnvironmentSignupPolicy(): SignupPolicy {
       return Promise.resolve({
         allowed: false,
         message: config.AUTH_SIGNUP_NOT_ALLOWED_MESSAGE ?? DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,
+        format: 'markdown',
       });
     },
   };

package/src/index.test.ts

@@ -94,6 +94,7 @@ describe('authModule', () => {
     ).resolves.toEqual({
       allowed: false,
       message: 'This Shipfox deployment does not accept new accounts right now.',
+      format: 'markdown',
     });
   });
 

package/src/index.ts

@@ -75,7 +75,7 @@ export {
   jobLeaseParamsFrom,
   verifyJobLeaseToken,
 } from '#core/job-lease-token.js';
-export type {SignupPolicy} from '#core/ports.js';
+export type {SignupDenialMessageFormat, SignupPolicy} from '#core/ports.js';
 export {
   issueRunnerSessionToken,
   verifyRunnerSessionToken,

package/src/presentation/routes/registration/signup.test.ts

@@ -53,6 +53,27 @@ describe('POST /auth/signup', () => {
     });
   });
 
+  test('declares Markdown denial messages in the client error details', () => {
+    const errorHandler = createSignupRoute({} as WorkspacesInterModuleClient).errorHandler as (
+      error: unknown,
+    ) => never;
+    const message = 'Read the [access policy](https://example.test/access).';
+    let mapped: unknown;
+
+    try {
+      errorHandler(new SignupNotAllowedError(message, 'markdown'));
+    } catch (error) {
+      mapped = error;
+    }
+
+    expect(mapped).toMatchObject({
+      message,
+      status: 403,
+      code: 'signup-not-allowed',
+      details: {message, format: 'markdown'},
+    });
+  });
+
   afterAll(async () => {
     await app.close();
   });

package/src/presentation/routes/registration/signup.ts

@@ -11,12 +11,10 @@ import {
   TokenExpiredError,
   TokenInvalidError,
 } from '#core/errors.js';
-import type {SignupPolicy} from '#core/ports.js';
+import {SIGNUP_DENIAL_MESSAGE_MAX_LENGTH, type SignupPolicy} from '#core/ports.js';
 import {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';
 import {toUserDto} from '#presentation/dto/user.js';
 
-const SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH = 500;
-
 export function createSignupRoute(
   workspaces: WorkspacesInterModuleClient,
   signupPolicy?: SignupPolicy,
@@ -43,10 +41,10 @@ export function createSignupRoute(
         throw new ClientError('Email already registered', 'email-taken', {status: 409});
       }
       if (error instanceof SignupNotAllowedError) {
-        const message = error.message.slice(0, SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH);
+        const message = error.message.slice(0, SIGNUP_DENIAL_MESSAGE_MAX_LENGTH);
         throw new ClientError(message, 'signup-not-allowed', {
           status: 403,
-          details: {message},
+          details: {message, ...(error.format ? {format: error.format} : {})},
         });
       }
       if (error instanceof TokenInvalidError) {

package/test/routes.ts

@@ -73,6 +73,7 @@ vi.mock('@shipfox/node-mailer', () => ({mailer: testConfig.mailer}));
 const CODE_RE = /\b\d{8}\b/u;
 const TOKEN_RE = /token=([\w\-_=]+)/;
 type AuthEmailEventType = typeof AUTH_PASSWORD_RESET_SEND_REQUESTED;
+type InjectResponse = Awaited<ReturnType<FastifyInstance['inject']>>;
 
 export const ROUTE_TEST_SECRET = userAccessTokenKey();
 export const acceptWorkspaceInvitationMock: ReturnType<typeof vi.fn> =
@@ -172,7 +173,7 @@ export async function createAuthTestApp(params?: {
 export async function signup(
   app: FastifyInstance,
   params: {email: string; password: string; name?: string},
-) {
+): Promise<InjectResponse> {
   const result = await app.inject({
     method: 'POST',
     url: '/auth/signup',
@@ -198,7 +199,10 @@ export async function verifyEmail(
   expect(res.statusCode).toBe(200);
 }
 
-export async function login(app: FastifyInstance, params: {email: string; password: string}) {
+export async function login(
+  app: FastifyInstance,
+  params: {email: string; password: string},
+): Promise<InjectResponse> {
   return await app.inject({
     method: 'POST',
     url: '/auth/login',