@shipfox/api-auth 17.0.0 → 18.0.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 68 files with swc (429.99ms)
+Successfully compiled: 68 files with swc (397.31ms)

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @shipfox/api-auth
 
+## 18.0.0
+
+### Patch Changes
+
+- Updated dependencies [fff528a]
+- Updated dependencies [defc3e6]
+  - @shipfox/api-auth-dto@18.0.0
+  - @shipfox/node-tokens@1.0.0
+  - @shipfox/api-auth-context@18.0.0
+
 ## 17.0.0
 
 ### Minor Changes

package/dist/core/runner-session-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner-session-token.d.ts","sourceRoot":"","sources":["../../src/core/runner-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,uBAAuB,CAAC;AAO/B,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAAC,wBAAwB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAElG,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,oFAAoF;AACpF,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C"}
+{"version":3,"file":"runner-session-token.d.ts","sourceRoot":"","sources":["../../src/core/runner-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,uBAAuB,CAAC;AAO/B,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAAC,wBAAwB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAElG,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,oFAAoF;AACpF,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C"}

package/dist/core/runner-session-token.js

@@ -10,7 +10,8 @@ export async function issueRunnerSessionToken(claims) {
             workspaceId: claims.workspaceId,
             scope: claims.scope,
             labels: claims.labels,
-            maxClaims: claims.maxClaims
+            maxClaims: claims.maxClaims,
+            lifecycleCapabilities: claims.lifecycleCapabilities
         },
         secret: runnerSessionTokenKey(),
         expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,

package/dist/core/runner-session-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/runner-session-token.ts"],"sourcesContent":["import {\n  RUNNER_SESSION_TOKEN_AUDIENCE,\n  type RunnerSessionTokenClaims,\n  runnerSessionTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;\n\nexport async function issueRunnerSessionToken(\n  claims: IssueRunnerSessionTokenParams,\n): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      runnerSessionId: claims.runnerSessionId,\n      workspaceId: claims.workspaceId,\n      scope: claims.scope,\n      labels: claims.labels,\n      maxClaims: claims.maxClaims,\n    },\n    secret: runnerSessionTokenKey(),\n    expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,\n    audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('runner_session');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input. Never throws. */\nexport async function verifyRunnerSessionToken(\n  token: string,\n): Promise<RunnerSessionTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: runnerSessionTokenKey(),\n      schema: runnerSessionTokenClaimsSchema,\n      audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('runner_session', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('runner_session', 'rejected');\n    return null;\n  }\n}\n"],"names":["RUNNER_SESSION_TOKEN_AUDIENCE","runnerSessionTokenClaimsSchema","runnerSessionTokenKey","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","issueRunnerSessionToken","claims","token","payload","runnerSessionId","workspaceId","scope","labels","maxClaims","secret","expiresIn","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","audience","verifyRunnerSessionToken","schema"],"mappings":"AAAA,SACEA,6BAA6B,EAE7BC,8BAA8B,QACzB,wBAAwB;AAC/B,SAAQC,qBAAqB,QAAO,8BAA8B;AAClE,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAKzE,OAAO,eAAeC,wBACpBC,MAAqC;IAErC,MAAMC,QAAQ,MAAMP,UAAU;QAC5BQ,SAAS;YACPC,iBAAiBH,OAAOG,eAAe;YACvCC,aAAaJ,OAAOI,WAAW;YAC/BC,OAAOL,OAAOK,KAAK;YACnBC,QAAQN,OAAOM,MAAM;YACrBC,WAAWP,OAAOO,SAAS;QAC7B;QACAC,QAAQf;QACRgB,WAAWb,OAAOc,oCAAoC;QACtDC,UAAUpB;IACZ;IACAM,kBAAkB;IAClB,OAAOI;AACT;AAEA,kFAAkF,GAClF,OAAO,eAAeW,yBACpBX,KAAa;IAEb,IAAI;QACF,MAAMD,SAAS,MAAML,YAAY;YAC/BM;YACAO,QAAQf;YACRoB,QAAQrB;YACRmB,UAAUpB;QACZ;QACAO,oBAAoB,kBAAkB;QACtC,OAAOE;IACT,EAAE,OAAM;QACNF,oBAAoB,kBAAkB;QACtC,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../src/core/runner-session-token.ts"],"sourcesContent":["import {\n  RUNNER_SESSION_TOKEN_AUDIENCE,\n  type RunnerSessionTokenClaims,\n  runnerSessionTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;\n\nexport async function issueRunnerSessionToken(\n  claims: IssueRunnerSessionTokenParams,\n): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      runnerSessionId: claims.runnerSessionId,\n      workspaceId: claims.workspaceId,\n      scope: claims.scope,\n      labels: claims.labels,\n      maxClaims: claims.maxClaims,\n      lifecycleCapabilities: claims.lifecycleCapabilities,\n    },\n    secret: runnerSessionTokenKey(),\n    expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,\n    audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('runner_session');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input. Never throws. */\nexport async function verifyRunnerSessionToken(\n  token: string,\n): Promise<RunnerSessionTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: runnerSessionTokenKey(),\n      schema: runnerSessionTokenClaimsSchema,\n      audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('runner_session', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('runner_session', 'rejected');\n    return null;\n  }\n}\n"],"names":["RUNNER_SESSION_TOKEN_AUDIENCE","runnerSessionTokenClaimsSchema","runnerSessionTokenKey","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","issueRunnerSessionToken","claims","token","payload","runnerSessionId","workspaceId","scope","labels","maxClaims","lifecycleCapabilities","secret","expiresIn","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","audience","verifyRunnerSessionToken","schema"],"mappings":"AAAA,SACEA,6BAA6B,EAE7BC,8BAA8B,QACzB,wBAAwB;AAC/B,SAAQC,qBAAqB,QAAO,8BAA8B;AAClE,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAKzE,OAAO,eAAeC,wBACpBC,MAAqC;IAErC,MAAMC,QAAQ,MAAMP,UAAU;QAC5BQ,SAAS;YACPC,iBAAiBH,OAAOG,eAAe;YACvCC,aAAaJ,OAAOI,WAAW;YAC/BC,OAAOL,OAAOK,KAAK;YACnBC,QAAQN,OAAOM,MAAM;YACrBC,WAAWP,OAAOO,SAAS;YAC3BC,uBAAuBR,OAAOQ,qBAAqB;QACrD;QACAC,QAAQhB;QACRiB,WAAWd,OAAOe,oCAAoC;QACtDC,UAAUrB;IACZ;IACAM,kBAAkB;IAClB,OAAOI;AACT;AAEA,kFAAkF,GAClF,OAAO,eAAeY,yBACpBZ,KAAa;IAEb,IAAI;QACF,MAAMD,SAAS,MAAML,YAAY;YAC/BM;YACAQ,QAAQhB;YACRqB,QAAQtB;YACRoB,UAAUrB;QACZ;QACAO,oBAAoB,kBAAkB;QACtC,OAAOE;IACT,EAAE,OAAM;QACNF,oBAAoB,kBAAkB;QACtC,OAAO;IACT;AACF"}