@shipfox/api-auth 15.0.0 → 17.0.0

package/src/presentation/auth/bearer-token-auth.ts

@@ -1,5 +1,5 @@
 import {type AuthMethod, ClientError, extractBearerToken} from '@shipfox/node-fastify';
-import type {FastifyRequest} from 'fastify';
+import type {FastifyReply, FastifyRequest} from 'fastify';
 
 interface UnauthorizedErrorParams {
   message: string;
@@ -11,7 +11,7 @@ interface BearerTokenAuthMethodOptions<TClaims> {
   verifyToken: (token: string) => Promise<TClaims | null>;
   isInvalidTokenError?: (error: unknown) => boolean;
   invalidTokenError: UnauthorizedErrorParams;
-  setContext: (request: FastifyRequest, claims: TClaims) => void;
+  setContext: (request: FastifyRequest, claims: TClaims, reply?: FastifyReply) => void;
 }
 
 const missingBearerError: UnauthorizedErrorParams = {
@@ -24,7 +24,7 @@ export function createBearerTokenAuthMethod<TClaims>(
 ): AuthMethod {
   return {
     name: options.name,
-    authenticate: async (request) => {
+    authenticate: async (request, reply) => {
       const token = extractBearerToken(request.headers.authorization);
       if (!token) throwUnauthorized(missingBearerError);
 
@@ -35,7 +35,7 @@ export function createBearerTokenAuthMethod<TClaims>(
       );
       if (!claims) throwUnauthorized(options.invalidTokenError);
 
-      options.setContext(request, claims);
+      options.setContext(request, claims, reply);
     },
   };
 }

package/src/presentation/auth/jwt-auth.test.ts

@@ -1,4 +1,5 @@
 import {userAccessTokenKey} from '@shipfox/node-auth-root-key';
+import {contextWithMetadata, trace} from '@shipfox/node-opentelemetry';
 import {hashOpaqueToken} from '@shipfox/node-tokens';
 import type {FastifyInstance} from 'fastify';
 import Fastify from 'fastify';
@@ -61,6 +62,32 @@ describe('jwt-auth', () => {
     expect(res.json().client.name).toBe('JWT User');
   });
 
+  test('decorates request.client with impersonatorId for marked sessions', async () => {
+    const user = await createUser({email: emailFor('jwt-impersonator'), hashedPassword: 'h'});
+    const impersonatorId = crypto.randomUUID();
+    const token = await signUserToken({
+      userId: user.id,
+      email: user.email,
+      name: 'JWT User',
+      memberships: [],
+      impersonatorId,
+      secret: SECRET,
+      expiresIn: '7d',
+    });
+
+    const res = await app.inject({
+      method: 'GET',
+      url: '/protected',
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json().client.userId).toBe(user.id);
+    expect(res.json().client.email).toBe(user.email);
+    expect(res.json().client.name).toBe('JWT User');
+    expect(res.json().client.impersonatorId).toBe(impersonatorId);
+  });
+
   test('401 on missing Authorization header', async () => {
     const res = await app.inject({method: 'GET', url: '/protected'});
 
@@ -261,3 +288,167 @@ describe('jwt-auth', () => {
     expect(res.statusCode).toBe(401);
   });
 });
+
+describe('request-log context', () => {
+  let logApp: FastifyInstance;
+  const records: Array<Record<string, unknown>> = [];
+
+  beforeAll(async () => {
+    const stream = {
+      write: (chunk: string) => {
+        records.push(JSON.parse(chunk) as Record<string, unknown>);
+      },
+    };
+    logApp = Fastify({logger: {level: 'info', stream}});
+    logApp.setValidatorCompiler(validatorCompiler);
+    logApp.setSerializerCompiler(serializerCompiler);
+
+    const authMethod = createJwtAuthMethod();
+    logApp.addHook('onRequest', async (request, reply) => {
+      await authMethod.authenticate(request, reply);
+    });
+    logApp.get('/log-probe', (request) => {
+      request.log.info({}, 'probe line');
+      return {ok: true};
+    });
+    await logApp.ready();
+  });
+
+  afterAll(async () => {
+    await logApp.close();
+  });
+
+  beforeEach(() => {
+    records.length = 0;
+  });
+
+  test('binds impersonatorId on the request logger for marked sessions', async () => {
+    const user = await createUser({email: emailFor('jwt-imp-log'), hashedPassword: 'h'});
+    const impersonatorId = crypto.randomUUID();
+    const token = await signUserToken({
+      userId: user.id,
+      email: user.email,
+      memberships: [],
+      impersonatorId,
+      secret: SECRET,
+      expiresIn: '7d',
+    });
+
+    const res = await logApp.inject({
+      method: 'GET',
+      url: '/log-probe',
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    const probe = [...records].reverse().find((record) => record.msg === 'probe line');
+    expect(probe).toBeDefined();
+    expect(probe?.impersonatorId).toBe(impersonatorId);
+    const completed = [...records].reverse().find((record) => record.msg === 'request completed');
+    expect(completed).toBeDefined();
+    expect(completed?.impersonatorId).toBe(impersonatorId);
+  });
+
+  test('leaves ordinary sessions unmarked in the request logger', async () => {
+    const user = await createUser({email: emailFor('jwt-plain-log'), hashedPassword: 'h'});
+    const token = await signUserToken({
+      userId: user.id,
+      email: user.email,
+      memberships: [],
+      secret: SECRET,
+      expiresIn: '7d',
+    });
+
+    const res = await logApp.inject({
+      method: 'GET',
+      url: '/log-probe',
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    const probe = [...records].reverse().find((record) => record.msg === 'probe line');
+    expect(probe).toBeDefined();
+    expect(probe?.impersonatorId).toBeUndefined();
+    const completed = [...records].reverse().find((record) => record.msg === 'request completed');
+    expect(completed).toBeDefined();
+    expect(completed?.impersonatorId).toBeUndefined();
+  });
+});
+
+describe('span context', () => {
+  let spanApp: FastifyInstance;
+  let setAttribute: ReturnType<typeof vi.spyOn>;
+
+  beforeAll(async () => {
+    const span = trace.getTracer('test').startSpan('request');
+    setAttribute = vi.spyOn(span, 'setAttribute');
+    spanApp = Fastify();
+    spanApp.setValidatorCompiler(validatorCompiler);
+    spanApp.setSerializerCompiler(serializerCompiler);
+    spanApp.decorateRequest('opentelemetry', () => ({
+      enabled: true,
+      span,
+      tracer: trace.getTracer('test'),
+      context: contextWithMetadata({}),
+      inject: () => undefined,
+      extract: () => contextWithMetadata({}),
+    }));
+
+    const authMethod = createJwtAuthMethod();
+    spanApp.addHook('onRequest', async (request, reply) => {
+      await authMethod.authenticate(request, reply);
+    });
+    spanApp.get('/span-probe', () => ({ok: true}));
+    await spanApp.ready();
+  });
+
+  beforeEach(() => {
+    setAttribute.mockClear();
+  });
+
+  afterAll(async () => {
+    await spanApp.close();
+  });
+
+  test('sets impersonatorId on the request span for marked sessions', async () => {
+    const user = await createUser({email: emailFor('jwt-imp-span'), hashedPassword: 'h'});
+    const impersonatorId = crypto.randomUUID();
+    const token = await signUserToken({
+      userId: user.id,
+      email: user.email,
+      memberships: [],
+      impersonatorId,
+      secret: SECRET,
+      expiresIn: '7d',
+    });
+
+    const res = await spanApp.inject({
+      method: 'GET',
+      url: '/span-probe',
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(setAttribute).toHaveBeenCalledWith('impersonatorId', impersonatorId);
+  });
+
+  test('sets no impersonatorId attribute on the request span for ordinary sessions', async () => {
+    const user = await createUser({email: emailFor('jwt-plain-span'), hashedPassword: 'h'});
+    const token = await signUserToken({
+      userId: user.id,
+      email: user.email,
+      memberships: [],
+      secret: SECRET,
+      expiresIn: '7d',
+    });
+
+    const res = await spanApp.inject({
+      method: 'GET',
+      url: '/span-probe',
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(setAttribute).not.toHaveBeenCalled();
+  });
+});

package/src/presentation/auth/jwt-auth.ts

@@ -7,6 +7,7 @@ import {
 } from '@shipfox/api-auth-context';
 import {userAccessTokenKey} from '@shipfox/node-auth-root-key';
 import {type AuthMethod, ClientError} from '@shipfox/node-fastify';
+import {enrichSpanWithMetadata} from '@shipfox/node-opentelemetry';
 import type {FastifyRequest} from 'fastify';
 import type {RefreshToken} from '#core/entities/refresh-token.js';
 import type {User} from '#core/entities/user.js';
@@ -85,15 +86,32 @@ export function createJwtAuthMethod(): AuthMethod {
     },
     isInvalidTokenError: (error) => error instanceof InvalidJwtTokenError,
     invalidTokenError: {message: 'Invalid or expired token', code: 'unauthorized'},
-    setContext: (request, claims) => {
+    setContext: (request, claims, reply) => {
       const clientContext: ClientContext = buildUserContext({
         userId: claims.sub,
         email: claims.email,
         name: claims.name ?? null,
         memberships: claims.memberships,
+        impersonatorId: claims.impersonatorId,
       });
       setUserContext(request, clientContext);
       setAuthenticatedSessionContext(request, claims);
+      if (claims.impersonatorId !== undefined) {
+        const impersonatorId = claims.impersonatorId;
+        // Marked sessions must stay attributable: bind the marker on the
+        // request logger and on the reply logger (Fastify captured the reply's
+        // logger before hooks ran), and on the request span rather than the
+        // short-lived hook span.
+        const markedLogger = request.log.child({impersonatorId});
+        request.log = markedLogger;
+        if (reply) {
+          reply.log = markedLogger;
+        }
+        const requestSpan = request.opentelemetry?.().span;
+        if (requestSpan) {
+          enrichSpanWithMetadata({impersonatorId}, {span: requestSpan});
+        }
+      }
     },
   });
 }