@shipfox/api-auth 2.0.0 → 4.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-auth",
   "license": "MIT",
-  "version": "2.0.0",
+  "version": "4.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -46,35 +46,35 @@
     "@node-rs/argon2": "^2.0.2",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-auth-context": "2.0.0",
+    "@shipfox/api-auth-context": "3.0.0",
     "@shipfox/api-auth-dto": "2.0.0",
-    "@shipfox/config": "1.2.1",
+    "@shipfox/api-workspaces": "4.0.0",
     "@shipfox/api-workspaces-dto": "2.0.0",
-    "@shipfox/node-drizzle": "0.2.1",
-    "@shipfox/node-fastify": "0.2.1",
-    "@shipfox/node-module": "0.2.0",
-    "@shipfox/node-opentelemetry": "0.5.0",
-    "@shipfox/node-outbox": "0.2.1",
+    "@shipfox/config": "1.2.1",
+    "@shipfox/node-drizzle": "0.3.0",
+    "@shipfox/node-fastify": "0.2.2",
     "@shipfox/node-jwt": "0.2.0",
+    "@shipfox/node-email": "0.2.1",
+    "@shipfox/node-mailer": "0.1.3",
+    "@shipfox/node-module": "0.3.1",
+    "@shipfox/node-opentelemetry": "0.5.1",
+    "@shipfox/node-outbox": "0.2.2",
     "@shipfox/node-postgres": "0.4.1",
     "@shipfox/node-rate-limit": "0.2.0",
-    "@shipfox/node-tokens": "0.2.0",
-    "@shipfox/node-mailer": "0.1.2",
-    "@shipfox/api-workspaces": "2.0.0",
-    "@shipfox/node-email": "0.2.1"
+    "@shipfox/node-tokens": "0.2.0"
   },
   "devDependencies": {
     "@types/pg": "^8.15.5",
     "drizzle-kit": "^0.31.10",
     "fastify": "^5.3.3",
     "fastify-type-provider-zod": "^6.0.0",
-    "fishery": "^2.2.2",
+    "fishery": "^2.4.0",
     "jose": "^6.0.0",
-    "@shipfox/swc": "1.2.5",
     "@shipfox/biome": "1.8.1",
+    "@shipfox/swc": "1.2.5",
+    "@shipfox/ts-config": "1.3.8",
     "@shipfox/typescript": "1.1.6",
-    "@shipfox/vitest": "1.2.2",
-    "@shipfox/ts-config": "1.3.8"
+    "@shipfox/vitest": "1.2.2"
   },
   "scripts": {
     "build": "shipfox-swc",

package/src/config.ts

@@ -1,4 +1,4 @@
-import {createConfig, num, str} from '@shipfox/config';
+import {bool, createConfig, num, str} from '@shipfox/config';
 import {createConsoleMailer, createSmtpMailer, type Mailer} from '@shipfox/node-mailer';
 
 export const config = createConfig({
@@ -35,6 +35,10 @@ export const config = createConfig({
     desc: 'Name of the browser cookie that stores the refresh token.',
     default: 'shipfox_refresh_token',
   }),
+  AUTH_PASSWORD_ENABLED: bool({
+    desc: 'Whether password login is available. Use true or false. Defaults to true. When false, password and email-verification routes are not registered, and server startup requires another module to contribute a login method.',
+    default: true,
+  }),
   RATE_LIMIT_IDENTIFIER_SECRET: str({
     desc: 'Optional secret used to HMAC identifiers before storing rate-limit counters. Leave it unset to derive a stable key from AUTH_JWT_SECRET.',
     default: undefined,

package/src/index.test.ts

@@ -4,6 +4,7 @@ import {
   authEventSchemas,
 } from '@shipfox/api-auth-dto';
 import {authModule} from './index.js';
+import {passwordLoginMethods} from './login-methods.js';
 
 vi.mock('#config.js', () => ({
   config: {
@@ -14,12 +15,19 @@ vi.mock('#config.js', () => ({
     AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: 14,
     AUTH_REFRESH_ROTATION_GRACE_SECONDS: 30,
     AUTH_REFRESH_COOKIE_NAME: 'shipfox_refresh_token',
+    AUTH_PASSWORD_ENABLED: true,
     CLIENT_BASE_URL: 'https://app.example.test',
   },
   mailer: {send: vi.fn()},
 }));
 
 describe('authModule', () => {
+  test('declares password login only when password login is enabled', () => {
+    expect(passwordLoginMethods(true)).toEqual([{id: 'password'}]);
+    expect(passwordLoginMethods(false)).toEqual([]);
+    expect(authModule.loginMethods).toEqual([{id: 'password'}]);
+  });
+
   test('registers auth email outbox publisher and subscribers', () => {
     const publisher = authModule.publishers?.find((pub) => pub.name === 'auth');
     const events = authModule.subscribers?.map((subscriber) => subscriber.event);

package/src/index.ts

@@ -6,6 +6,7 @@ import {
 } from '@shipfox/api-auth-dto';
 import type {ShipfoxModule} from '@shipfox/node-module';
 import {subscriberFactory} from '@shipfox/node-module';
+import {config} from '#config.js';
 import {db} from '#db/db.js';
 import {migrationsPath} from '#db/migrations.js';
 import {authOutbox} from '#db/schema/outbox.js';
@@ -18,6 +19,7 @@ import {
   onEmailVerificationSendRequested,
   onPasswordResetSendRequested,
 } from '#presentation/subscribers/index.js';
+import {passwordLoginMethods} from './login-methods.js';
 
 export type {JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';
 export type {
@@ -59,6 +61,7 @@ export const authModule: ShipfoxModule = {
   name: 'auth',
   database: {db, migrationsPath},
   auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],
+  loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),
   routes: [authRoutes],
   e2eRoutes: [authE2eRoutes],
   publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authEventSchemas}],

package/src/login-methods.ts

@@ -0,0 +1,5 @@
+import type {LoginMethod} from '@shipfox/node-module';
+
+export function passwordLoginMethods(passwordEnabled: boolean): LoginMethod[] {
+  return passwordEnabled ? [{id: 'password'}] : [];
+}

package/src/presentation/auth/refresh-cookie.test.ts

@@ -5,6 +5,7 @@ vi.mock('#config.js', () => ({
   config: {
     AUTH_REFRESH_COOKIE_NAME: 'shipfox_refresh_token',
     AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: 14,
+    AUTH_PASSWORD_ENABLED: true,
   },
 }));
 

package/src/presentation/routes/index.test.ts

@@ -0,0 +1,67 @@
+import {createApp} from '@shipfox/node-fastify';
+import {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';
+import {buildAuthRoutes} from './index.js';
+
+const disabledPasswordPaths = [
+  '/auth/signup',
+  '/auth/verify-email/confirm',
+  '/auth/verify-email/resend',
+  '/auth/login',
+  '/auth/change-password',
+  '/auth/password-reset',
+  '/auth/password-reset/confirm',
+];
+
+describe('buildAuthRoutes', () => {
+  test('preserves the default route table when password login is enabled', () => {
+    const routes = buildAuthRoutes(true);
+
+    expect(routes.routes.map((route) => ('path' in route ? route.path : route.prefix))).toEqual([
+      '/signup',
+      '/verify-email/confirm',
+      '/verify-email/resend',
+      '/login',
+      '/refresh',
+      '/logout',
+      '/me',
+      '/change-password',
+      '/password-reset',
+      '/password-reset/confirm',
+    ]);
+  });
+
+  test('keeps only session lifecycle routes when password login is disabled', () => {
+    const routes = buildAuthRoutes(false);
+
+    expect(routes.routes.map((route) => ('path' in route ? route.path : route.prefix))).toEqual([
+      '/refresh',
+      '/logout',
+      '/me',
+    ]);
+  });
+
+  test('does not register password or email-verification routes when password login is disabled', async () => {
+    const app = await createApp({
+      auth: [createJwtAuthMethod()],
+      routes: [buildAuthRoutes(false)],
+      swagger: false,
+    });
+
+    try {
+      for (const url of disabledPasswordPaths) {
+        const response = await app.inject({method: 'POST', url});
+        expect(response.statusCode).toBe(404);
+      }
+
+      const refresh = await app.inject({method: 'POST', url: '/auth/refresh'});
+      const logout = await app.inject({method: 'POST', url: '/auth/logout'});
+      const me = await app.inject({method: 'GET', url: '/auth/me'});
+
+      expect(refresh.statusCode).not.toBe(404);
+      expect(logout.statusCode).not.toBe(404);
+      expect(me.statusCode).not.toBe(404);
+    } finally {
+      await app.close();
+    }
+  });
+});

package/src/presentation/routes/index.ts

@@ -1,4 +1,5 @@
 import type {RouteGroup} from '@shipfox/node-fastify';
+import {config} from '#config.js';
 import {authCookiePlugin} from '#presentation/auth/refresh-cookie.js';
 import {verifyEmailConfirmRoute} from './email-verification/verify-email-confirm.js';
 import {verifyEmailResendRoute} from './email-verification/verify-email-resend.js';
@@ -11,19 +12,24 @@ import {logoutRoute} from './session/logout.js';
 import {meRoute} from './session/me.js';
 import {refreshRoute} from './session/refresh.js';
 
-export const authRoutes: RouteGroup = {
-  prefix: '/auth',
-  plugins: [authCookiePlugin],
-  routes: [
-    signupRoute,
-    verifyEmailConfirmRoute,
-    verifyEmailResendRoute,
-    loginRoute,
-    refreshRoute,
-    logoutRoute,
-    meRoute,
-    changePasswordRoute,
-    passwordResetRequestRoute,
-    passwordResetConfirmRoute,
-  ],
-};
+export function buildAuthRoutes(passwordEnabled: boolean): RouteGroup {
+  const passwordRoutes = passwordEnabled
+    ? [signupRoute, verifyEmailConfirmRoute, verifyEmailResendRoute, loginRoute]
+    : [];
+
+  return {
+    prefix: '/auth',
+    plugins: [authCookiePlugin],
+    routes: [
+      ...passwordRoutes,
+      refreshRoute,
+      logoutRoute,
+      meRoute,
+      ...(passwordEnabled
+        ? [changePasswordRoute, passwordResetRequestRoute, passwordResetConfirmRoute]
+        : []),
+    ],
+  };
+}
+
+export const authRoutes = buildAuthRoutes(config.AUTH_PASSWORD_ENABLED);

package/test/routes.ts

@@ -81,6 +81,7 @@ vi.mock('#config.js', () => ({
     AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: 14,
     AUTH_REFRESH_ROTATION_GRACE_SECONDS: 30,
     AUTH_REFRESH_COOKIE_NAME: 'shipfox_refresh_token',
+    AUTH_PASSWORD_ENABLED: true,
     CLIENT_BASE_URL: testConfig.clientBaseUrl,
   },
   mailer: testConfig.mailer,