@shipfox/api-auth 18.0.0 → 20.0.0

package/src/db/db.ts

@@ -2,6 +2,14 @@ import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';
 import {pgClient} from '@shipfox/node-postgres';
 import {adminCommandResults} from './schema/admin-command-results.js';
 import {adminGrants} from './schema/admin-grants.js';
+import {
+  agentAuthorizationCodes,
+  agentAuthorizationRequests,
+  agentClients,
+  agentGrants,
+  agentPersonalAccessTokens,
+  agentRefreshTokens,
+} from './schema/agent-access.js';
 import {authOutbox} from './schema/outbox.js';
 import {passwordResets} from './schema/password-resets.js';
 import {authRateLimits} from './schema/rate-limits.js';
@@ -10,6 +18,12 @@ import {users} from './schema/users.js';
 
 export const schema = {
   adminGrants,
+  agentClients,
+  agentAuthorizationRequests,
+  agentGrants,
+  agentAuthorizationCodes,
+  agentRefreshTokens,
+  agentPersonalAccessTokens,
   adminCommandResults,
   users,
   passwordResets,

package/src/db/schema/agent-access.ts

@@ -0,0 +1,273 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {sql} from 'drizzle-orm';
+import {index, pgEnum, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import type {
+  AgentAuthorizationCode,
+  AgentAuthorizationRequest,
+  AgentClient,
+  AgentClientKind,
+  AgentGrant,
+  AgentPersonalAccessToken,
+  AgentRefreshToken,
+} from '#core/entities/agent-access.js';
+import {pgTable} from './common.js';
+import {users} from './users.js';
+
+export const agentClientKindEnum = pgEnum('auth_agent_client_kind', ['registered', 'cimd']);
+
+export const agentClients = pgTable(
+  'agent_clients',
+  {
+    id: uuidv7PrimaryKey(),
+    clientId: text('client_id').notNull(),
+    name: text('name').notNull(),
+    redirectUris: text('redirect_uris').array().notNull(),
+    kind: agentClientKindEnum('kind').notNull(),
+    lastSeenAt: timestamp('last_seen_at', {withTimezone: true}),
+    unreferencedAt: timestamp('unreferenced_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('auth_agent_clients_client_id_unique').on(table.clientId),
+    index('auth_agent_clients_unreferenced_at_idx').on(table.unreferencedAt),
+    index('auth_agent_clients_created_at_idx').on(table.createdAt),
+  ],
+);
+
+export const agentAuthorizationRequests = pgTable(
+  'agent_authorization_requests',
+  {
+    id: uuidv7PrimaryKey(),
+    clientId: uuid('client_id')
+      .notNull()
+      .references(() => agentClients.id, {onDelete: 'cascade'}),
+    redirectUri: text('redirect_uri').notNull(),
+    resource: text('resource').notNull(),
+    scopes: text('scopes').array().notNull(),
+    codeChallenge: text('code_challenge').notNull(),
+    state: text('state'),
+    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+    consumedAt: timestamp('consumed_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    index('auth_agent_authorization_requests_client_id_idx').on(table.clientId),
+    index('auth_agent_authorization_requests_expires_at_idx').on(table.expiresAt),
+  ],
+);
+
+export const agentGrants = pgTable(
+  'agent_grants',
+  {
+    id: uuidv7PrimaryKey(),
+    userId: uuid('user_id')
+      .notNull()
+      .references(() => users.id, {onDelete: 'cascade'}),
+    workspaceId: uuid('workspace_id').notNull(),
+    clientId: uuid('client_id')
+      .notNull()
+      .references(() => agentClients.id, {onDelete: 'cascade'}),
+    scopes: text('scopes').array().notNull(),
+    lastUsedAt: timestamp('last_used_at', {withTimezone: true}),
+    revokedAt: timestamp('revoked_at', {withTimezone: true}),
+    terminalAt: timestamp('terminal_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    index('auth_agent_grants_user_id_idx').on(table.userId),
+    index('auth_agent_grants_workspace_id_idx').on(table.workspaceId),
+    index('auth_agent_grants_client_id_idx').on(table.clientId),
+    index('auth_agent_grants_terminal_at_idx').on(table.terminalAt),
+    uniqueIndex('auth_agent_grants_active_user_workspace_client_unique')
+      .on(table.userId, table.workspaceId, table.clientId)
+      .where(sql`${table.revokedAt} IS NULL AND ${table.terminalAt} IS NULL`),
+  ],
+);
+
+export const agentAuthorizationCodes = pgTable(
+  'agent_authorization_codes',
+  {
+    id: uuidv7PrimaryKey(),
+    grantId: uuid('grant_id')
+      .notNull()
+      .references(() => agentGrants.id, {onDelete: 'cascade'}),
+    hashedCode: text('hashed_code').notNull(),
+    codeChallenge: text('code_challenge').notNull(),
+    redirectUri: text('redirect_uri').notNull(),
+    resource: text('resource').notNull(),
+    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+    consumedAt: timestamp('consumed_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('auth_agent_authorization_codes_hashed_code_unique').on(table.hashedCode),
+    index('auth_agent_authorization_codes_grant_id_idx').on(table.grantId),
+    index('auth_agent_authorization_codes_expires_at_idx').on(table.expiresAt),
+  ],
+);
+
+export const agentRefreshTokens = pgTable(
+  'agent_refresh_tokens',
+  {
+    id: uuidv7PrimaryKey(),
+    grantId: uuid('grant_id')
+      .notNull()
+      .references(() => agentGrants.id, {onDelete: 'cascade'}),
+    hashedToken: text('hashed_token').notNull(),
+    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+    rotatedAt: timestamp('rotated_at', {withTimezone: true}),
+    revokedAt: timestamp('revoked_at', {withTimezone: true}),
+    lastUsedAt: timestamp('last_used_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('auth_agent_refresh_tokens_hashed_token_unique').on(table.hashedToken),
+    uniqueIndex('auth_agent_refresh_tokens_live_grant_unique')
+      .on(table.grantId)
+      .where(sql`${table.rotatedAt} IS NULL AND ${table.revokedAt} IS NULL`),
+    index('auth_agent_refresh_tokens_grant_id_idx').on(table.grantId),
+    index('auth_agent_refresh_tokens_expires_at_idx').on(table.expiresAt),
+    index('auth_agent_refresh_tokens_rotated_at_idx').on(table.rotatedAt),
+    index('auth_agent_refresh_tokens_revoked_at_idx').on(table.revokedAt),
+  ],
+);
+
+export const agentPersonalAccessTokens = pgTable(
+  'agent_pats',
+  {
+    id: uuidv7PrimaryKey(),
+    userId: uuid('user_id')
+      .notNull()
+      .references(() => users.id, {onDelete: 'cascade'}),
+    workspaceId: uuid('workspace_id').notNull(),
+    hashedToken: text('hashed_token').notNull(),
+    prefix: text('prefix').notNull(),
+    name: text('name').notNull(),
+    scopes: text('scopes').array().notNull(),
+    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+    lastUsedAt: timestamp('last_used_at', {withTimezone: true}),
+    revokedAt: timestamp('revoked_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('auth_agent_pats_hashed_token_unique').on(table.hashedToken),
+    index('auth_agent_pats_user_id_idx').on(table.userId),
+    index('auth_agent_pats_workspace_id_idx').on(table.workspaceId),
+    index('auth_agent_pats_expires_at_idx').on(table.expiresAt),
+    index('auth_agent_pats_revoked_at_idx').on(table.revokedAt),
+  ],
+);
+
+export type AgentClientDb = typeof agentClients.$inferSelect;
+export type AgentClientCreateDb = typeof agentClients.$inferInsert;
+export type AgentAuthorizationRequestDb = typeof agentAuthorizationRequests.$inferSelect;
+export type AgentAuthorizationRequestCreateDb = typeof agentAuthorizationRequests.$inferInsert;
+export type AgentGrantDb = typeof agentGrants.$inferSelect;
+export type AgentGrantCreateDb = typeof agentGrants.$inferInsert;
+export type AgentAuthorizationCodeDb = typeof agentAuthorizationCodes.$inferSelect;
+export type AgentAuthorizationCodeCreateDb = typeof agentAuthorizationCodes.$inferInsert;
+export type AgentRefreshTokenDb = typeof agentRefreshTokens.$inferSelect;
+export type AgentRefreshTokenCreateDb = typeof agentRefreshTokens.$inferInsert;
+export type AgentPersonalAccessTokenDb = typeof agentPersonalAccessTokens.$inferSelect;
+export type AgentPersonalAccessTokenCreateDb = typeof agentPersonalAccessTokens.$inferInsert;
+
+export function toAgentClient(row: AgentClientDb): AgentClient {
+  return {
+    id: row.id,
+    clientId: row.clientId,
+    name: row.name,
+    redirectUris: row.redirectUris,
+    kind: row.kind as AgentClientKind,
+    lastSeenAt: row.lastSeenAt,
+    unreferencedAt: row.unreferencedAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export function toAgentAuthorizationRequest(
+  row: AgentAuthorizationRequestDb,
+): AgentAuthorizationRequest {
+  return {
+    id: row.id,
+    clientId: row.clientId,
+    redirectUri: row.redirectUri,
+    resource: row.resource,
+    scopes: row.scopes,
+    codeChallenge: row.codeChallenge,
+    state: row.state,
+    expiresAt: row.expiresAt,
+    consumedAt: row.consumedAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export function toAgentGrant(row: AgentGrantDb): AgentGrant {
+  return {
+    id: row.id,
+    userId: row.userId,
+    workspaceId: row.workspaceId,
+    clientId: row.clientId,
+    scopes: row.scopes,
+    lastUsedAt: row.lastUsedAt,
+    revokedAt: row.revokedAt,
+    terminalAt: row.terminalAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export function toAgentAuthorizationCode(row: AgentAuthorizationCodeDb): AgentAuthorizationCode {
+  return {
+    id: row.id,
+    grantId: row.grantId,
+    hashedCode: row.hashedCode,
+    codeChallenge: row.codeChallenge,
+    redirectUri: row.redirectUri,
+    resource: row.resource,
+    expiresAt: row.expiresAt,
+    consumedAt: row.consumedAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export function toAgentRefreshToken(row: AgentRefreshTokenDb): AgentRefreshToken {
+  return {
+    id: row.id,
+    grantId: row.grantId,
+    hashedToken: row.hashedToken,
+    expiresAt: row.expiresAt,
+    rotatedAt: row.rotatedAt,
+    revokedAt: row.revokedAt,
+    lastUsedAt: row.lastUsedAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export function toAgentPersonalAccessToken(
+  row: AgentPersonalAccessTokenDb,
+): AgentPersonalAccessToken {
+  return {
+    id: row.id,
+    userId: row.userId,
+    workspaceId: row.workspaceId,
+    hashedToken: row.hashedToken,
+    prefix: row.prefix,
+    name: row.name,
+    scopes: row.scopes,
+    expiresAt: row.expiresAt,
+    lastUsedAt: row.lastUsedAt,
+    revokedAt: row.revokedAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}

package/src/db/schema/users.ts

@@ -1,5 +1,6 @@
 import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
-import {pgEnum, text, timestamp, uniqueIndex} from 'drizzle-orm/pg-core';
+import {desc} from 'drizzle-orm';
+import {index, pgEnum, text, timestamp, uniqueIndex} from 'drizzle-orm/pg-core';
 import type {User, UserStatus} from '#core/entities/user.js';
 import {pgTable} from './common.js';
 
@@ -14,10 +15,15 @@ export const users = pgTable(
     name: text('name'),
     emailVerifiedAt: timestamp('email_verified_at', {withTimezone: true}),
     status: userStatusEnum('status').notNull().default('active'),
-    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    createdAt: timestamp('created_at', {withTimezone: true, precision: 3}).notNull().defaultNow(),
     updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
   },
-  (table) => [uniqueIndex('auth_users_email_unique').on(table.email)],
+  (table) => [
+    uniqueIndex('auth_users_email_unique').on(table.email),
+    index('auth_users_created_at_id_index').on(desc(table.createdAt), desc(table.id)),
+    index('auth_users_name_trgm_index').using('gin', table.name.op('gin_trgm_ops')),
+    index('auth_users_email_trgm_index').using('gin', table.email.op('gin_trgm_ops')),
+  ],
 );
 
 export type UserDb = typeof users.$inferSelect;

package/src/index.test.ts

@@ -1,12 +1,21 @@
+import {dirname, resolve} from 'node:path';
+import {fileURLToPath} from 'node:url';
 import {
   AUTH_PASSWORD_RESET_SEND_REQUESTED,
   AUTH_USER_SIGNED_UP,
   authEventSchemas,
 } from '@shipfox/api-auth-dto';
 import {ADMINISTRATION_ACTION_PERFORMED} from '@shipfox/api-common-dto';
+import {createAuthMaintenanceActivities} from '#temporal/activities/index.js';
 import {createAuthModule} from './index.js';
 import {passwordLoginMethods} from './login-methods.js';
 
+const expectedWorkflowsPath = resolve(
+  dirname(fileURLToPath(import.meta.url)),
+  '..',
+  'dist/temporal/workflows/index.js',
+);
+
 type SignupPolicyLike = {
   isSignupAllowed(params: {
     email: string;
@@ -110,4 +119,22 @@ describe('authModule', () => {
     ]);
     expect(events).toEqual(expect.arrayContaining([AUTH_PASSWORD_RESET_SEND_REQUESTED]));
   });
+
+  test('registers the agent-access retention worker', () => {
+    const worker = authModule.workers?.[0];
+    expect(worker).toEqual(
+      expect.objectContaining({
+        taskQueue: 'auth-agent-access-maintenance',
+        workflowsPath: expectedWorkflowsPath,
+        workflows: [
+          {
+            name: 'agentAccessRetentionCron',
+            id: 'auth-agent-access-retention',
+            cronSchedule: '10 * * * *',
+          },
+        ],
+      }),
+    );
+    expect(worker?.activities).toBe(createAuthMaintenanceActivities);
+  });
 });

package/src/index.ts

@@ -1,3 +1,5 @@
+import {dirname, resolve} from 'node:path';
+import {fileURLToPath} from 'node:url';
 import {
   AUTH_PASSWORD_RESET_SEND_REQUESTED,
   type AuthEventMap,
@@ -24,9 +26,13 @@ import {
 } from '#presentation/routes/administration.js';
 import {buildAuthRoutes} from '#presentation/routes/index.js';
 import {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';
+import {createAuthMaintenanceActivities} from '#temporal/activities/index.js';
+import {AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE} from '#temporal/constants.js';
 import {passwordLoginMethods} from './login-methods.js';
 
 const authPublisherEventSchemas = {...authEventSchemas, ...administrationActionEventSchemas};
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const workflowsPath = resolve(packageRoot, 'dist/temporal/workflows/index.js');
 
 export type {AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';
 export {
@@ -37,10 +43,15 @@ export {
   requireAdminRole,
   revokeAdminGrant,
 } from '#core/admin-role.js';
+export type {
+  ListAdministratorUsersParams,
+  ListAdministratorUsersResult,
+} from '#core/administration.js';
 export {
   bootstrapFirstAdminOwner,
   grantAdministratorRole,
   impersonateUser,
+  listAdministratorUsers,
   reactivateAdministratorUser,
   revokeAdministratorGrant,
   revokeAdministratorUserSessions,
@@ -55,6 +66,20 @@ export type {
   ProvisionUserParams,
 } from '#core/auth.js';
 export {createImpersonatedSessionToken, createSessionForUser, provisionUser} from '#core/auth.js';
+export type {
+  CimdAddress,
+  CimdAddressResolver,
+  CimdHttpRequester,
+  CimdHttpResponse,
+  FetchCimdMetadataOptions,
+  FetchedCimdMetadata,
+} from '#core/cimd.js';
+export {
+  fetchClientIdMetadata,
+  isPublicUnicastAddress,
+  OAUTH_CIMD_FETCH_TIMEOUT_MS,
+  OAUTH_CIMD_MAX_BODY_BYTES,
+} from '#core/cimd.js';
 export type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';
 export {findUserByEmail} from '#core/email-owner.js';
 export type {AdminGrant} from '#core/entities/admin-grant.js';
@@ -73,8 +98,13 @@ export {
   ImpersonationExpiredError,
   ImpersonationTargetNotActiveError,
   InvalidAdminBootstrapTokenError,
+  InvalidAdministratorUserDirectoryFilterError,
   InvalidCredentialsError,
+  InvalidOAuthClientMetadataError,
+  InvalidOAuthConfigurationError,
   LastAdminOwnerError,
+  OAuthMetadataFetchError,
+  OAuthRedirectUriNotRegisteredError,
   SignupNotAllowedError,
   UserNotFoundError,
 } from '#core/errors.js';
@@ -83,6 +113,38 @@ export {
   jobLeaseParamsFrom,
   verifyJobLeaseToken,
 } from '#core/job-lease-token.js';
+export type {OAuthGrantType, ValidatedOAuthClientMetadata} from '#core/oauth-client.js';
+export {
+  assertOAuthClientMetadataMatchesRequest,
+  assertOAuthRedirectUriRegistered,
+  isOAuthLoopbackRedirectUri,
+  metadataForAgentClient,
+  OAUTH_CIMD_CACHE_MAX_AGE_SECONDS,
+  OAUTH_CLIENT_ID_MAX_BYTES,
+  OAUTH_CLIENT_NAME_MAX_BYTES,
+  OAUTH_REDIRECT_URI_MAX_BYTES,
+  OAUTH_REDIRECT_URI_MAX_COUNT,
+  oauthRedirectUriMatches,
+  validateOAuthClientId,
+  validateOAuthClientMetadataDocument,
+  validateOAuthDynamicClientRegistration,
+  validateOAuthPublicOrigin,
+  validateOAuthRedirectUri,
+} from '#core/oauth-client.js';
+export type {
+  OAuthClientResolver,
+  OAuthClientResolverOptions,
+  RegisteredOAuthClient,
+  RegisterOAuthClientParams,
+  ResolvedOAuthClient,
+  ResolveOAuthClientParams,
+} from '#core/oauth-client-resolver.js';
+export {
+  createOAuthClientResolver,
+  OAUTH_CIMD_CACHE_MAX_ENTRIES,
+  registerOAuthClient,
+  resolveOAuthClient,
+} from '#core/oauth-client-resolver.js';
 export type {SignupDenialMessageFormat, SignupPolicy} from '#core/ports.js';
 export {
   issueRunnerSessionToken,
@@ -108,6 +170,12 @@ export {
   setRefreshTokenCookie,
 } from '#presentation/auth/refresh-cookie.js';
 export {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';
+export type {CreateOAuthRoutesOptions} from '#presentation/routes/oauth.js';
+export {
+  createOAuthClientIdentificationRoutes,
+  createOAuthMetadataRoutes,
+  createOAuthRoutes,
+} from '#presentation/routes/oauth.js';
 
 const subscriber = subscriberFactory<AuthEventMap>();
 
@@ -134,6 +202,20 @@ export function createAuthModule({
     e2eRoutes: [createAuthE2eRoutes(workspaces)],
     publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authPublisherEventSchemas}],
     subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],
+    workers: [
+      {
+        taskQueue: AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE,
+        workflowsPath,
+        activities: createAuthMaintenanceActivities,
+        workflows: [
+          {
+            name: 'agentAccessRetentionCron',
+            id: 'auth-agent-access-retention',
+            cronSchedule: '10 * * * *',
+          },
+        ],
+      },
+    ],
     interModulePresentations: [createAuthInterModulePresentation()],
   };
 }

package/src/metrics/instance.ts

@@ -9,7 +9,12 @@ export type AuthRateLimitAction =
   | 'bootstrap'
   | 'bootstrap-state'
   | 'lookup'
-  | 'impersonate';
+  | 'directory'
+  | 'impersonate'
+  | 'oauth-register'
+  | 'oauth-cimd'
+  | 'oauth-authorize'
+  | 'oauth-token';
 export type AuthRateLimitScope = 'ip' | 'email' | 'actor';
 export type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';
 export type AuthImpersonationOutcome = 'succeeded' | 'failed';