@shipfox/api-auth 15.0.0 → 18.0.0

package/src/core/jwt.ts

@@ -11,20 +11,39 @@ export const tokenMembershipSchema = z.object({
 
 export type TokenMembership = z.infer<typeof tokenMembershipSchema>;
 
-export const userTokenClaimsSchema = z.object({
-  sub: z.string().uuid(),
-  refreshSessionId: z.string().uuid().optional(),
-  email: z.string().email(),
-  name: z.string().nullable().optional(),
-  memberships: z.array(tokenMembershipSchema),
-  iat: z.number().int(),
-  exp: z.number().int(),
-});
+const impersonatorIdSchema = z.string().uuid();
+
+// UUIDs are case-insensitive hex strings: compare normalized values so a
+// re-cased impersonatorId cannot pass off the subject as its own impersonator.
+function isSameUuid(a: string, b: string): boolean {
+  return a.toLowerCase() === b.toLowerCase();
+}
+
+// Rollback hazard: pre-impersonation verifiers strip unknown claims (zod's
+// default object parsing), so a marked token verified by an old build silently
+// loses the marker. Upgrade every verifier before any issuer mints marked tokens.
+export const userTokenClaimsSchema = z
+  .object({
+    sub: z.string().uuid(),
+    refreshSessionId: z.string().uuid().optional(),
+    impersonatorId: impersonatorIdSchema.optional(),
+    email: z.string().email(),
+    name: z.string().nullable().optional(),
+    memberships: z.array(tokenMembershipSchema),
+    iat: z.number().int(),
+    exp: z.number().int(),
+  })
+  .refine(
+    (claims) =>
+      claims.impersonatorId === undefined || !isSameUuid(claims.impersonatorId, claims.sub),
+    {message: 'impersonatorId must differ from sub'},
+  );
 
 export type UserTokenClaims = z.infer<typeof userTokenClaimsSchema>;
 
 export interface SignUserTokenParams {
   refreshSessionId?: string | undefined;
+  impersonatorId?: string | undefined;
   userId: string;
   email: string;
   name?: string | null | undefined;
@@ -39,12 +58,22 @@ export interface VerifyUserTokenParams {
 }
 
 export async function signUserToken(params: SignUserTokenParams): Promise<string> {
+  if (params.impersonatorId !== undefined) {
+    if (!impersonatorIdSchema.safeParse(params.impersonatorId).success) {
+      throw new TypeError('impersonatorId must be a UUID');
+    }
+    if (isSameUuid(params.impersonatorId, params.userId)) {
+      throw new TypeError('impersonatorId must differ from userId');
+    }
+  }
+
   const token = await signHs256({
     payload: {
       email: params.email,
       name: params.name ?? null,
       memberships: params.memberships,
       refreshSessionId: params.refreshSessionId,
+      impersonatorId: params.impersonatorId,
     },
     secret: params.secret,
     expiresIn: params.expiresIn,

package/src/core/runner-session-token.test.ts

@@ -14,6 +14,7 @@ function claims() {
     scope: 'workspace' as const,
     labels: ['linux', 'x64'],
     maxClaims: null,
+    lifecycleCapabilities: ['local_execution_fence_v1'],
   };
 }
 
@@ -30,6 +31,7 @@ describe('runner-session-token', () => {
     expect(verified?.scope).toBe(input.scope);
     expect(verified?.labels).toEqual(input.labels);
     expect(verified?.maxClaims).toBeNull();
+    expect(verified?.lifecycleCapabilities).toEqual(input.lifecycleCapabilities);
     expect(verified?.aud).toBe(RUNNER_SESSION_TOKEN_AUDIENCE);
     expect(verified?.iat).toBeTypeOf('number');
     expect(verified?.exp).toBeGreaterThan(verified?.iat ?? 0);

package/src/core/runner-session-token.ts

@@ -21,6 +21,7 @@ export async function issueRunnerSessionToken(
       scope: claims.scope,
       labels: claims.labels,
       maxClaims: claims.maxClaims,
+      lifecycleCapabilities: claims.lifecycleCapabilities,
     },
     secret: runnerSessionTokenKey(),
     expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,

package/src/db/admin-command.ts

@@ -22,6 +22,16 @@ export interface AdminCommandTransactionParams {
   event: AdministrationActionEvent;
 }
 
+export type AdminCommandResultLookup = Pick<
+  AdminCommandTransactionParams,
+  'actorId' | 'idempotencyKeyFingerprint' | 'requestFingerprint'
+> & {command: string};
+
+export type AdminCommandResultKey = Pick<
+  AdminCommandTransactionParams,
+  'actorId' | 'idempotencyKeyFingerprint' | 'requestFingerprint'
+>;
+
 export async function lockAdminCommand(
   tx: Tx,
   params: Pick<AdminCommandTransactionParams, 'actorId' | 'idempotencyKeyFingerprint'>,
@@ -37,10 +47,7 @@ export async function lockAdminOwnerGrants(tx: Tx): Promise<void> {
 
 export async function findAdminCommandResult(
   tx: Tx,
-  params: Pick<
-    AdminCommandTransactionParams,
-    'actorId' | 'idempotencyKeyFingerprint' | 'requestFingerprint'
-  > & {command: string},
+  params: AdminCommandResultLookup,
 ): Promise<AdminCommandResultDb | undefined> {
   const rows = await tx
     .select()
@@ -65,18 +72,40 @@ export async function findAdminCommandResult(
 
 export async function storeAdminCommandResult(
   tx: Tx,
-  params: AdminCommandTransactionParams,
+  params: AdminCommandResultLookup,
   result: StoredAdminCommandResult,
 ): Promise<void> {
   await tx.insert(adminCommandResults).values({
     actorId: params.actorId,
     idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,
-    command: params.event.command,
+    command: params.command,
     requestFingerprint: params.requestFingerprint,
     result,
   });
 }
 
+/**
+ * Replaces the stored result of an already-committed command, used by
+ * impersonation replays to append the newly issued token's fingerprint while
+ * keeping the original `expires_at`.
+ */
+export async function updateAdminCommandResult(
+  tx: Tx,
+  params: AdminCommandResultKey,
+  result: StoredAdminCommandResult,
+): Promise<void> {
+  await tx
+    .update(adminCommandResults)
+    .set({result})
+    .where(
+      and(
+        eq(adminCommandResults.actorId, params.actorId),
+        eq(adminCommandResults.idempotencyKeyFingerprint, params.idempotencyKeyFingerprint),
+        eq(adminCommandResults.requestFingerprint, params.requestFingerprint),
+      ),
+    );
+}
+
 export async function writeAdminAction(tx: Tx, event: AdministrationActionEvent): Promise<void> {
   await writeOutboxEvent<AdministrationActionEventMap>(tx, authOutbox, {
     type: 'administration.action.performed',

package/src/db/admin-grants.ts

@@ -218,7 +218,11 @@ async function storeCommandResult(
   params: AuditedAdminCommandParams,
   grant: AdminGrant,
 ): Promise<void> {
-  await storeAdminCommandResult(tx, params, {grant: toStoredAdminGrant(grant)});
+  await storeAdminCommandResult(
+    tx,
+    {...params, command: params.event.command},
+    {grant: toStoredAdminGrant(grant)},
+  );
 }
 
 export async function bootstrapFirstAdminOwner(

package/src/db/admin-user-moderation.ts

@@ -1,3 +1,4 @@
+import type {AdminRole} from '@shipfox/api-auth-dto';
 import type {AdministrationActionEvent} from '@shipfox/api-common-dto';
 import {and, eq, gt, isNull, sql} from 'drizzle-orm';
 import {hasMinimumAdminRole, highestAdminRole} from '#core/admin-role-model.js';
@@ -84,7 +85,11 @@ async function storeCommandResult(
   params: UserModerationCommandParams,
   result: StoredAdminUserModerationResult,
 ): Promise<void> {
-  await storeAdminCommandResult(tx, params, {userModeration: result});
+  await storeAdminCommandResult(
+    tx,
+    {...params, command: params.event.command},
+    {userModeration: result},
+  );
 }
 
 async function readTargetUserForUpdate(tx: Tx, userId: string) {
@@ -99,7 +104,7 @@ async function readTargetUserForUpdate(tx: Tx, userId: string) {
   return user;
 }
 
-async function requireActiveAdminOperator(tx: Tx, actorId: string): Promise<void> {
+export async function requireActiveAdminOperator(tx: Tx, actorId: string): Promise<AdminRole> {
   const actorRows = await tx
     .select({status: users.status})
     .from(users)
@@ -115,6 +120,7 @@ async function requireActiveAdminOperator(tx: Tx, actorId: string): Promise<void
   if (actor?.status !== 'active' || !role || !hasMinimumAdminRole(role, 'admin-operator')) {
     throw new AdminRoleRequiredError('admin-operator');
   }
+  return role;
 }
 
 async function revokeActiveSessions(tx: Tx, userId: string): Promise<number> {

package/src/db/impersonation.ts

@@ -0,0 +1,323 @@
+import type {AdminRole} from '@shipfox/api-auth-dto';
+import {
+  ADMINISTRATION_ACTION_PERFORMED,
+  type AdministrationActionEvent,
+  type AdministrationActionResult,
+  createAdministrationActionEvent,
+} from '@shipfox/api-common-dto';
+import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';
+import {hashOpaqueToken} from '@shipfox/node-tokens';
+import {and, eq, isNull, sql} from 'drizzle-orm';
+import {highestAdminRole} from '#core/admin-role-model.js';
+import {
+  type CreateImpersonatedSessionTokenResult,
+  createImpersonatedSessionToken,
+} from '#core/auth.js';
+import {
+  CannotImpersonateAdministratorError,
+  CannotImpersonateSelfError,
+  ImpersonationExpiredError,
+  ImpersonationTargetNotActiveError,
+  UserNotFoundError,
+} from '#core/errors.js';
+import {
+  findAdminCommandResult,
+  lockAdminCommand,
+  lockAdminOwnerGrants,
+  storeAdminCommandResult,
+  type Tx,
+  updateAdminCommandResult,
+  writeAdminAction,
+} from './admin-command.js';
+import {requireActiveAdminOperator} from './admin-user-moderation.js';
+import {db} from './db.js';
+import type {StoredImpersonationResult} from './schema/admin-command-results.js';
+import {adminGrants} from './schema/admin-grants.js';
+import {authOutbox} from './schema/outbox.js';
+import {users} from './schema/users.js';
+
+export const IMPERSONATE_COMMAND = 'auth.user.impersonate';
+const IMPERSONATE_REQUIRED_ROLE: AdminRole = 'admin-operator';
+
+export interface ImpersonationCommandParams {
+  actorId: string;
+  targetUserId: string;
+  reason: string;
+  idempotencyKeyFingerprint: string;
+  requestFingerprint: string;
+  correlationId: string;
+  workspaces: WorkspacesInterModuleClient;
+}
+
+export interface ImpersonationResult {
+  token: string;
+  expiresAt: Date;
+  user: CreateImpersonatedSessionTokenResult['user'];
+  impersonatorId: string;
+  correlationId: string;
+}
+
+interface ImpersonationEventFields {
+  actorId: string;
+  targetUserId: string;
+  reason: string;
+  actorRole: AdminRole;
+  idempotencyKeyFingerprint: string;
+  correlationId: string;
+}
+
+function impersonationEvent(
+  params: ImpersonationEventFields,
+  result: AdministrationActionResult,
+): AdministrationActionEvent {
+  return createAdministrationActionEvent({
+    actorId: params.actorId,
+    actorRole: params.actorRole,
+    requiredRole: IMPERSONATE_REQUIRED_ROLE,
+    command: IMPERSONATE_COMMAND,
+    targetType: 'user',
+    targetId: params.targetUserId,
+    reason: params.reason,
+    result,
+    correlationId: params.correlationId,
+    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,
+    occurredAt: new Date().toISOString(),
+  });
+}
+
+function isSameUuid(a: string, b: string): boolean {
+  return a.toLowerCase() === b.toLowerCase();
+}
+
+/** Rule 5: the target exists, is active, and has a verified email. */
+async function requireEligibleImpersonationTarget(tx: Tx, targetUserId: string): Promise<void> {
+  const rows = await tx
+    .select({emailVerifiedAt: users.emailVerifiedAt, status: users.status})
+    .from(users)
+    .where(eq(users.id, targetUserId))
+    .limit(1);
+  const target = rows[0];
+  if (!target || target.status === 'deleted') throw new UserNotFoundError(targetUserId);
+  if (target.emailVerifiedAt === null) throw new ImpersonationTargetNotActiveError();
+  if (target.status !== 'active') throw new ImpersonationTargetNotActiveError();
+}
+
+/** Rule 6: the target holds no active administrator grant of any role. */
+async function requireNonAdministratorTarget(tx: Tx, targetUserId: string): Promise<void> {
+  const grants = await tx
+    .select({role: adminGrants.role})
+    .from(adminGrants)
+    .innerJoin(users, eq(adminGrants.userId, users.id))
+    .where(
+      and(
+        eq(adminGrants.userId, targetUserId),
+        isNull(adminGrants.revokedAt),
+        eq(users.status, 'active'),
+      ),
+    );
+  if (highestAdminRole(grants.map(({role}) => role)) !== null) {
+    throw new CannotImpersonateAdministratorError();
+  }
+}
+
+/**
+ * The in-transaction authorization and eligibility ladder (rules 2, 4, 5, and
+ * 6). Rule 1 (`AUTH_IMPERSONATION_ENABLED`) is a configuration read checked at
+ * the command entry and inside the mint primitive, and rule 3 (the actor's own
+ * session is not impersonated) is the positional `/admin` route guard; all run
+ * on every invocation, replay included. Returns the actor's current role read
+ * in this transaction, so the audit event records the role that actually
+ * authorized the mint rather than a pre-transaction snapshot.
+ */
+async function runImpersonationLadder(
+  tx: Tx,
+  params: {actorId: string; targetUserId: string},
+): Promise<AdminRole> {
+  const actorRole = await requireActiveAdminOperator(tx, params.actorId);
+  if (isSameUuid(params.targetUserId, params.actorId)) throw new CannotImpersonateSelfError();
+  await requireEligibleImpersonationTarget(tx, params.targetUserId);
+  await requireNonAdministratorTarget(tx, params.targetUserId);
+  return actorRole;
+}
+
+function toImpersonationResult(
+  params: ImpersonationCommandParams,
+  minted: CreateImpersonatedSessionTokenResult,
+  expiresAt: Date,
+): ImpersonationResult {
+  return {
+    token: minted.token,
+    expiresAt,
+    user: minted.user,
+    impersonatorId: params.actorId,
+    correlationId: params.correlationId,
+  };
+}
+
+/**
+ * True when the current invocation's mint committed: a `succeeded` event
+ * carrying this invocation's `correlationId` is durable under the idempotency
+ * key. The event is written atomically with the result row, and the
+ * correlationId is unique per request, so a result row committed by an earlier
+ * mint or replay under the same key can never be mistaken for this
+ * invocation's commit. The command entry reconciles against this before
+ * publishing a `failed` event for an unexpected error: if the event exists,
+ * the mint transaction committed (the driver may still have raised on the
+ * COMMIT acknowledgement), so a failure event would contradict the durable
+ * `succeeded` trail.
+ */
+export async function impersonationSucceededEventExists(params: {
+  actorId: string;
+  idempotencyKeyFingerprint: string;
+  correlationId: string;
+}): Promise<boolean> {
+  const rows = await db()
+    .select({id: authOutbox.id})
+    .from(authOutbox)
+    .where(
+      and(
+        eq(authOutbox.eventType, ADMINISTRATION_ACTION_PERFORMED),
+        sql`${authOutbox.payload}->>'command' = ${IMPERSONATE_COMMAND}`,
+        sql`${authOutbox.payload}->>'actorId' = ${params.actorId}`,
+        sql`${authOutbox.payload}->>'idempotencyKeyFingerprint' = ${params.idempotencyKeyFingerprint}`,
+        sql`${authOutbox.payload}->>'correlationId' = ${params.correlationId}`,
+        sql`${authOutbox.payload}->>'result' = 'succeeded'`,
+      ),
+    )
+    .limit(1);
+  return rows.length > 0;
+}
+
+export async function impersonateUserWithAudit(
+  params: ImpersonationCommandParams,
+): Promise<ImpersonationResult> {
+  return await db().transaction(async (tx) => {
+    await lockAdminCommand(tx, params);
+    // Every audited administrator grant mutation (bootstrap, grant, revoke,
+    // and suspension) takes this advisory lock, so serializing the ladder and
+    // the mint against it closes the race where a concurrent grant mutation
+    // changes actor or target eligibility after the ladder read but before
+    // the token is signed.
+    await lockAdminOwnerGrants(tx);
+
+    const existing = await findAdminCommandResult(tx, {
+      actorId: params.actorId,
+      idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,
+      requestFingerprint: params.requestFingerprint,
+      command: IMPERSONATE_COMMAND,
+    });
+
+    if (existing) {
+      if (!('impersonation' in existing.result)) {
+        throw new Error('Administrator command result has an unexpected shape');
+      }
+      const stored = existing.result.impersonation as StoredImpersonationResult;
+
+      // A replay hands back a usable bearer token, so it is an issuance, not a
+      // read: it re-runs the full ladder and re-signs instead of returning the
+      // stored result, and a replay after expiry is a terminal failure.
+      const storedExpiresAt = new Date(stored.expiresAt);
+      if (storedExpiresAt.getTime() <= Date.now()) throw new ImpersonationExpiredError();
+      const actorRole = await runImpersonationLadder(tx, {
+        actorId: params.actorId,
+        targetUserId: stored.targetUserId,
+      });
+
+      // A replay never extends the window: the re-signed token's TTL is the
+      // remaining time to the canonical `expiresAt`, so a sub-second remainder
+      // is treated as already-expired instead of flooring up to a new token.
+      const remainingSeconds = Math.floor((storedExpiresAt.getTime() - Date.now()) / 1000);
+      if (remainingSeconds <= 0) throw new ImpersonationExpiredError();
+      const minted = await createImpersonatedSessionToken({
+        targetUserId: stored.targetUserId,
+        impersonatorId: params.actorId,
+        workspaces: params.workspaces,
+        expiresIn: `${remainingSeconds}s`,
+      });
+      const fingerprint = hashOpaqueToken(minted.token);
+      await updateAdminCommandResult(
+        tx,
+        {
+          actorId: params.actorId,
+          idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,
+          requestFingerprint: params.requestFingerprint,
+        },
+        {
+          impersonation: {
+            ...stored,
+            tokenFingerprints: [...stored.tokenFingerprints, fingerprint],
+          },
+        },
+      );
+      // Replays publish their own event with the same idempotency-key
+      // fingerprint: the second event under one fingerprint is the replay
+      // marker. It commits atomically with the updated command result.
+      await writeAdminAction(tx, impersonationEvent({...params, actorRole}, 'succeeded'));
+      return toImpersonationResult(params, minted, storedExpiresAt);
+    }
+
+    const actorRole = await runImpersonationLadder(tx, {
+      actorId: params.actorId,
+      targetUserId: params.targetUserId,
+    });
+    const minted = await createImpersonatedSessionToken({
+      targetUserId: params.targetUserId,
+      impersonatorId: params.actorId,
+      workspaces: params.workspaces,
+    });
+    const stored: StoredImpersonationResult = {
+      targetUserId: params.targetUserId,
+      expiresAt: minted.expiresAt.toISOString(),
+      tokenFingerprints: [hashOpaqueToken(minted.token)],
+    };
+    await storeAdminCommandResult(
+      tx,
+      {
+        actorId: params.actorId,
+        idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,
+        requestFingerprint: params.requestFingerprint,
+        command: IMPERSONATE_COMMAND,
+      },
+      {impersonation: stored},
+    );
+    await writeAdminAction(tx, impersonationEvent({...params, actorRole}, 'succeeded'));
+    return toImpersonationResult(params, minted, minted.expiresAt);
+  });
+}
+
+/**
+ * Publishes a `failed` administration event from its own committed
+ * transaction. The main command transaction rolls back on failure and the role
+ * check runs before it opens, so an event written inside it would disappear;
+ * without this a denied attempt leaves no trace on the one route where failed
+ * attempts matter most. The strict event schema requires an actor role, so a
+ * role-less actor's denial (nothing but the role gate itself) is not recorded.
+ */
+export async function publishImpersonationFailure(params: {
+  actorId: string;
+  targetUserId: string;
+  reason: string;
+  actorRole: AdminRole | null;
+  idempotencyKeyFingerprint: string;
+  correlationId: string;
+}): Promise<void> {
+  if (!params.actorRole) return;
+  const event = impersonationEvent(
+    {
+      actorId: params.actorId,
+      targetUserId: params.targetUserId,
+      reason: params.reason,
+      actorRole: params.actorRole,
+      idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,
+      correlationId: params.correlationId,
+    },
+    'failed',
+  );
+  try {
+    await db().transaction(async (tx) => {
+      await writeAdminAction(tx, event);
+    });
+  } catch {
+    // The failure event must never mask the original command error.
+  }
+}

package/src/db/schema/admin-command-results.ts

@@ -30,12 +30,30 @@ export interface StoredAdminUserModerationResult {
   sessionsRevoked: number;
 }
 
+/**
+ * The stored impersonation command result: fingerprint-only, never a bearer
+ * token or a claims snapshot. Each entry is the SHA-256 of one token issued
+ * under the idempotency key, so a token recovered from a log or proxy capture
+ * can be matched back to the command, its actor, and its reason. A replay
+ * issues a token with different signature bytes and appends its fingerprint.
+ * `expiresAt` is canonical for replays: they re-sign with the original
+ * expiry and never extend the window.
+ */
+export interface StoredImpersonationResult {
+  targetUserId: string;
+  expiresAt: string;
+  tokenFingerprints: string[];
+}
+
 export type StoredAdminCommandResult =
   | {
       grant: StoredAdminGrant;
     }
   | {
       userModeration: StoredAdminUserModerationResult;
+    }
+  | {
+      impersonation: StoredImpersonationResult;
     };
 
 export const adminCommandResults = pgTable(

package/src/index.test.ts

@@ -78,7 +78,7 @@ describe('authModule', () => {
         getWorkspaceOperatingState: vi.fn(),
       },
     });
-    expect(module.routes).toHaveLength(4);
+    expect(module.routes).toHaveLength(5);
     expect(module.routes).toEqual(
       expect.arrayContaining([expect.objectContaining({prefix: '/admin/auth'})]),
     );

package/src/index.ts

@@ -20,7 +20,7 @@ import {createAuthInterModulePresentation} from '#presentation/inter-module.js';
 import {
   administrationBootstrapRoutes,
   administrationRoutes,
-  administrationUserRoutes,
+  createAdministrationUserRoutes,
 } from '#presentation/routes/administration.js';
 import {buildAuthRoutes} from '#presentation/routes/index.js';
 import {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';
@@ -40,18 +40,21 @@ export {
 export {
   bootstrapFirstAdminOwner,
   grantAdministratorRole,
+  impersonateUser,
   reactivateAdministratorUser,
   revokeAdministratorGrant,
   revokeAdministratorUserSessions,
   suspendAdministratorUser,
 } from '#core/administration.js';
 export type {
+  CreateImpersonatedSessionTokenParams,
+  CreateImpersonatedSessionTokenResult,
   CreateSessionForUserError,
   CreateSessionForUserParams,
   CreateSessionForUserResult,
   ProvisionUserParams,
 } from '#core/auth.js';
-export {createSessionForUser, provisionUser} from '#core/auth.js';
+export {createImpersonatedSessionToken, createSessionForUser, provisionUser} from '#core/auth.js';
 export type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';
 export {findUserByEmail} from '#core/email-owner.js';
 export type {AdminGrant} from '#core/entities/admin-grant.js';
@@ -63,7 +66,12 @@ export {
   AdminIdempotencyKeyReuseError,
   AdminRoleRequiredError,
   AuthDependencyUnavailableError,
+  CannotImpersonateAdministratorError,
+  CannotImpersonateSelfError,
   EmailNotVerifiedError,
+  ImpersonationDisabledError,
+  ImpersonationExpiredError,
+  ImpersonationTargetNotActiveError,
   InvalidAdminBootstrapTokenError,
   InvalidCredentialsError,
   LastAdminOwnerError,
@@ -84,6 +92,7 @@ export {
   createEnvironmentSignupPolicy,
   DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,
 } from '#core/signup-policy.js';
+export type {ImpersonationResult} from '#db/impersonation.js';
 export {
   type AuthenticatedSessionContext,
   createJwtAuthMethod,
@@ -120,7 +129,7 @@ export function createAuthModule({
       buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces, signupPolicy),
       administrationBootstrapRoutes,
       administrationRoutes,
-      administrationUserRoutes,
+      ...createAdministrationUserRoutes(workspaces),
     ],
     e2eRoutes: [createAuthE2eRoutes(workspaces)],
     publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authPublisherEventSchemas}],

package/src/metrics/index.ts

@@ -1,4 +1,5 @@
 export {
+  type AuthImpersonationOutcome,
   type AuthRateLimitAction,
   type AuthRateLimitOutcome,
   type AuthRateLimitScope,
@@ -7,6 +8,7 @@ export {
   type AuthTokenVerificationOutcome,
   recordAuthRateLimitCheck,
   recordAuthRateLimitPruneFailure,
+  recordImpersonationOutcome,
   recordTokenIssued,
   recordTokenRefreshed,
   recordTokenVerified,