@shipfox/api-auth 2.0.0

package/dist/presentation/e2eRoutes/index.js

@@ -0,0 +1,15 @@
+import cookie from '@fastify/cookie';
+import { createE2eSessionRoute } from './create-session.js';
+import { createE2eUserRoute } from './create-user.js';
+export const authE2eRoutes = {
+    prefix: '/auth',
+    plugins: [
+        cookie
+    ],
+    routes: [
+        createE2eUserRoute,
+        createE2eSessionRoute
+    ]
+};
+
+//# sourceMappingURL=index.js.map

package/dist/presentation/e2eRoutes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/e2eRoutes/index.ts"],"sourcesContent":["import cookie from '@fastify/cookie';\nimport type {RouteGroup} from '@shipfox/node-fastify';\nimport {createE2eSessionRoute} from './create-session.js';\nimport {createE2eUserRoute} from './create-user.js';\n\nexport const authE2eRoutes: RouteGroup = {\n  prefix: '/auth',\n  plugins: [cookie],\n  routes: [createE2eUserRoute, createE2eSessionRoute],\n};\n"],"names":["cookie","createE2eSessionRoute","createE2eUserRoute","authE2eRoutes","prefix","plugins","routes"],"mappings":"AAAA,OAAOA,YAAY,kBAAkB;AAErC,SAAQC,qBAAqB,QAAO,sBAAsB;AAC1D,SAAQC,kBAAkB,QAAO,mBAAmB;AAEpD,OAAO,MAAMC,gBAA4B;IACvCC,QAAQ;IACRC,SAAS;QAACL;KAAO;IACjBM,QAAQ;QAACJ;QAAoBD;KAAsB;AACrD,EAAE"}

package/dist/presentation/routes/email-verification/verify-email-confirm.d.ts

@@ -0,0 +1,2 @@
+export declare const verifyEmailConfirmRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=verify-email-confirm.d.ts.map

package/dist/presentation/routes/email-verification/verify-email-confirm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-email-confirm.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/email-verification/verify-email-confirm.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,uBAAuB,iDA0BlC,CAAC"}

package/dist/presentation/routes/email-verification/verify-email-confirm.js

@@ -0,0 +1,35 @@
+import { verifyEmailConfirmBodySchema, verifyEmailConfirmResponseSchema } from '@shipfox/api-auth-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { confirmEmailVerification } from '#core/auth.js';
+import { TokenInvalidError } from '#core/errors.js';
+import { setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
+import { toAuthSessionDto } from '#presentation/dto/user.js';
+export const verifyEmailConfirmRoute = defineRoute({
+    method: 'POST',
+    path: '/verify-email/confirm',
+    description: 'Verify a user email address with the link sent by email.',
+    schema: {
+        body: verifyEmailConfirmBodySchema,
+        response: {
+            200: verifyEmailConfirmResponseSchema
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof TokenInvalidError) {
+            throw new ClientError('Verification token is invalid or expired', 'token-invalid', {
+                status: 410
+            });
+        }
+        throw error;
+    },
+    handler: async (request, reply)=>{
+        const { token } = request.body;
+        const result = await confirmEmailVerification({
+            token
+        });
+        setRefreshTokenCookie(reply, result.refreshToken);
+        return toAuthSessionDto(result);
+    }
+});
+
+//# sourceMappingURL=verify-email-confirm.js.map

package/dist/presentation/routes/email-verification/verify-email-confirm.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/presentation/routes/email-verification/verify-email-confirm.ts"],"sourcesContent":["import {\n  verifyEmailConfirmBodySchema,\n  verifyEmailConfirmResponseSchema,\n} from '@shipfox/api-auth-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {confirmEmailVerification} from '#core/auth.js';\nimport {TokenInvalidError} from '#core/errors.js';\nimport {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';\nimport {toAuthSessionDto} from '#presentation/dto/user.js';\n\nexport const verifyEmailConfirmRoute = defineRoute({\n  method: 'POST',\n  path: '/verify-email/confirm',\n  description: 'Verify a user email address with the link sent by email.',\n  schema: {\n    body: verifyEmailConfirmBodySchema,\n    response: {\n      200: verifyEmailConfirmResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof TokenInvalidError) {\n      throw new ClientError('Verification token is invalid or expired', 'token-invalid', {\n        status: 410,\n      });\n    }\n    throw error;\n  },\n  handler: async (request, reply) => {\n    const {token} = request.body;\n\n    const result = await confirmEmailVerification({token});\n    setRefreshTokenCookie(reply, result.refreshToken);\n\n    return toAuthSessionDto(result);\n  },\n});\n"],"names":["verifyEmailConfirmBodySchema","verifyEmailConfirmResponseSchema","ClientError","defineRoute","confirmEmailVerification","TokenInvalidError","setRefreshTokenCookie","toAuthSessionDto","verifyEmailConfirmRoute","method","path","description","schema","body","response","errorHandler","error","status","handler","request","reply","token","result","refreshToken"],"mappings":"AAAA,SACEA,4BAA4B,EAC5BC,gCAAgC,QAC3B,wBAAwB;AAC/B,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,wBAAwB,QAAO,gBAAgB;AACvD,SAAQC,iBAAiB,QAAO,kBAAkB;AAClD,SAAQC,qBAAqB,QAAO,uCAAuC;AAC3E,SAAQC,gBAAgB,QAAO,4BAA4B;AAE3D,OAAO,MAAMC,0BAA0BL,YAAY;IACjDM,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMb;QACNc,UAAU;YACR,KAAKb;QACP;IACF;IACAc,cAAc,CAACC;QACb,IAAIA,iBAAiBX,mBAAmB;YACtC,MAAM,IAAIH,YAAY,4CAA4C,iBAAiB;gBACjFe,QAAQ;YACV;QACF;QACA,MAAMD;IACR;IACAE,SAAS,OAAOC,SAASC;QACvB,MAAM,EAACC,KAAK,EAAC,GAAGF,QAAQN,IAAI;QAE5B,MAAMS,SAAS,MAAMlB,yBAAyB;YAACiB;QAAK;QACpDf,sBAAsBc,OAAOE,OAAOC,YAAY;QAEhD,OAAOhB,iBAAiBe;IAC1B;AACF,GAAG"}

package/dist/presentation/routes/email-verification/verify-email-resend.d.ts

@@ -0,0 +1,2 @@
+export declare const verifyEmailResendRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=verify-email-resend.d.ts.map

package/dist/presentation/routes/email-verification/verify-email-resend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-email-resend.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/email-verification/verify-email-resend.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,sBAAsB,iDAoBjC,CAAC"}

package/dist/presentation/routes/email-verification/verify-email-resend.js

@@ -0,0 +1,27 @@
+import { verifyEmailResendBodySchema, verifyEmailResendResponseSchema } from '@shipfox/api-auth-dto';
+import { defineRoute } from '@shipfox/node-fastify';
+import { resendEmailVerification } from '#core/auth.js';
+import { createAuthRateLimitPreHandler } from '#presentation/routes/rate-limit.js';
+export const verifyEmailResendRoute = defineRoute({
+    method: 'POST',
+    path: '/verify-email/resend',
+    description: 'Send a new email verification link if the account can be verified.',
+    schema: {
+        body: verifyEmailResendBodySchema,
+        response: {
+            200: verifyEmailResendResponseSchema
+        }
+    },
+    preHandler: createAuthRateLimitPreHandler('email-send'),
+    handler: async (request, reply)=>{
+        const { email } = request.body;
+        const result = await resendEmailVerification({
+            email
+        });
+        reply.code(200).send({
+            next_resend_available_at: result.nextResendAvailableAt.toISOString()
+        });
+    }
+});
+
+//# sourceMappingURL=verify-email-resend.js.map

package/dist/presentation/routes/email-verification/verify-email-resend.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/presentation/routes/email-verification/verify-email-resend.ts"],"sourcesContent":["import {verifyEmailResendBodySchema, verifyEmailResendResponseSchema} from '@shipfox/api-auth-dto';\nimport {defineRoute} from '@shipfox/node-fastify';\nimport {resendEmailVerification} from '#core/auth.js';\nimport {createAuthRateLimitPreHandler} from '#presentation/routes/rate-limit.js';\n\nexport const verifyEmailResendRoute = defineRoute({\n  method: 'POST',\n  path: '/verify-email/resend',\n  description: 'Send a new email verification link if the account can be verified.',\n  schema: {\n    body: verifyEmailResendBodySchema,\n    response: {\n      200: verifyEmailResendResponseSchema,\n    },\n  },\n  preHandler: createAuthRateLimitPreHandler('email-send'),\n  handler: async (request, reply) => {\n    const {email} = request.body;\n\n    const result = await resendEmailVerification({email});\n\n    reply.code(200).send({\n      next_resend_available_at: result.nextResendAvailableAt.toISOString(),\n    });\n  },\n});\n"],"names":["verifyEmailResendBodySchema","verifyEmailResendResponseSchema","defineRoute","resendEmailVerification","createAuthRateLimitPreHandler","verifyEmailResendRoute","method","path","description","schema","body","response","preHandler","handler","request","reply","email","result","code","send","next_resend_available_at","nextResendAvailableAt","toISOString"],"mappings":"AAAA,SAAQA,2BAA2B,EAAEC,+BAA+B,QAAO,wBAAwB;AACnG,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,uBAAuB,QAAO,gBAAgB;AACtD,SAAQC,6BAA6B,QAAO,qCAAqC;AAEjF,OAAO,MAAMC,yBAAyBH,YAAY;IAChDI,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMV;QACNW,UAAU;YACR,KAAKV;QACP;IACF;IACAW,YAAYR,8BAA8B;IAC1CS,SAAS,OAAOC,SAASC;QACvB,MAAM,EAACC,KAAK,EAAC,GAAGF,QAAQJ,IAAI;QAE5B,MAAMO,SAAS,MAAMd,wBAAwB;YAACa;QAAK;QAEnDD,MAAMG,IAAI,CAAC,KAAKC,IAAI,CAAC;YACnBC,0BAA0BH,OAAOI,qBAAqB,CAACC,WAAW;QACpE;IACF;AACF,GAAG"}

package/dist/presentation/routes/index.d.ts

@@ -0,0 +1,3 @@
+import type { RouteGroup } from '@shipfox/node-fastify';
+export declare const authRoutes: RouteGroup;
+//# sourceMappingURL=index.d.ts.map

package/dist/presentation/routes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AAatD,eAAO,MAAM,UAAU,EAAE,UAexB,CAAC"}

package/dist/presentation/routes/index.js

@@ -0,0 +1,31 @@
+import { authCookiePlugin } from '#presentation/auth/refresh-cookie.js';
+import { verifyEmailConfirmRoute } from './email-verification/verify-email-confirm.js';
+import { verifyEmailResendRoute } from './email-verification/verify-email-resend.js';
+import { changePasswordRoute } from './password/change-password.js';
+import { passwordResetConfirmRoute } from './password/password-reset-confirm.js';
+import { passwordResetRequestRoute } from './password/password-reset-request.js';
+import { signupRoute } from './registration/signup.js';
+import { loginRoute } from './session/login.js';
+import { logoutRoute } from './session/logout.js';
+import { meRoute } from './session/me.js';
+import { refreshRoute } from './session/refresh.js';
+export const authRoutes = {
+    prefix: '/auth',
+    plugins: [
+        authCookiePlugin
+    ],
+    routes: [
+        signupRoute,
+        verifyEmailConfirmRoute,
+        verifyEmailResendRoute,
+        loginRoute,
+        refreshRoute,
+        logoutRoute,
+        meRoute,
+        changePasswordRoute,
+        passwordResetRequestRoute,
+        passwordResetConfirmRoute
+    ]
+};
+
+//# sourceMappingURL=index.js.map

package/dist/presentation/routes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/index.ts"],"sourcesContent":["import type {RouteGroup} from '@shipfox/node-fastify';\nimport {authCookiePlugin} from '#presentation/auth/refresh-cookie.js';\nimport {verifyEmailConfirmRoute} from './email-verification/verify-email-confirm.js';\nimport {verifyEmailResendRoute} from './email-verification/verify-email-resend.js';\nimport {changePasswordRoute} from './password/change-password.js';\nimport {passwordResetConfirmRoute} from './password/password-reset-confirm.js';\nimport {passwordResetRequestRoute} from './password/password-reset-request.js';\nimport {signupRoute} from './registration/signup.js';\nimport {loginRoute} from './session/login.js';\nimport {logoutRoute} from './session/logout.js';\nimport {meRoute} from './session/me.js';\nimport {refreshRoute} from './session/refresh.js';\n\nexport const authRoutes: RouteGroup = {\n  prefix: '/auth',\n  plugins: [authCookiePlugin],\n  routes: [\n    signupRoute,\n    verifyEmailConfirmRoute,\n    verifyEmailResendRoute,\n    loginRoute,\n    refreshRoute,\n    logoutRoute,\n    meRoute,\n    changePasswordRoute,\n    passwordResetRequestRoute,\n    passwordResetConfirmRoute,\n  ],\n};\n"],"names":["authCookiePlugin","verifyEmailConfirmRoute","verifyEmailResendRoute","changePasswordRoute","passwordResetConfirmRoute","passwordResetRequestRoute","signupRoute","loginRoute","logoutRoute","meRoute","refreshRoute","authRoutes","prefix","plugins","routes"],"mappings":"AACA,SAAQA,gBAAgB,QAAO,uCAAuC;AACtE,SAAQC,uBAAuB,QAAO,+CAA+C;AACrF,SAAQC,sBAAsB,QAAO,8CAA8C;AACnF,SAAQC,mBAAmB,QAAO,gCAAgC;AAClE,SAAQC,yBAAyB,QAAO,uCAAuC;AAC/E,SAAQC,yBAAyB,QAAO,uCAAuC;AAC/E,SAAQC,WAAW,QAAO,2BAA2B;AACrD,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,WAAW,QAAO,sBAAsB;AAChD,SAAQC,OAAO,QAAO,kBAAkB;AACxC,SAAQC,YAAY,QAAO,uBAAuB;AAElD,OAAO,MAAMC,aAAyB;IACpCC,QAAQ;IACRC,SAAS;QAACb;KAAiB;IAC3Bc,QAAQ;QACNR;QACAL;QACAC;QACAK;QACAG;QACAF;QACAC;QACAN;QACAE;QACAD;KACD;AACH,EAAE"}

package/dist/presentation/routes/password/change-password.d.ts

@@ -0,0 +1,2 @@
+export declare const changePasswordRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=change-password.d.ts.map

package/dist/presentation/routes/password/change-password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-password.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/password/change-password.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,mBAAmB,iDAmC9B,CAAC"}

package/dist/presentation/routes/password/change-password.js

@@ -0,0 +1,50 @@
+import { AUTH_USER } from '@shipfox/api-auth-context';
+import { changePasswordBodySchema } from '@shipfox/api-auth-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { z } from 'zod';
+import { changePassword } from '#core/auth.js';
+import { InvalidCredentialsError, UserNotFoundError } from '#core/errors.js';
+import { getClientContext } from '#presentation/auth/jwt-auth.js';
+import { getRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
+export const changePasswordRoute = defineRoute({
+    method: 'POST',
+    path: '/change-password',
+    description: 'Change the signed-in user password.',
+    auth: AUTH_USER,
+    schema: {
+        body: changePasswordBodySchema,
+        response: {
+            204: z.void()
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof UserNotFoundError) {
+            throw new ClientError('User not found', 'not-found', {
+                status: 404
+            });
+        }
+        if (error instanceof InvalidCredentialsError) {
+            throw new ClientError('Invalid credentials', 'invalid-credentials', {
+                status: 401
+            });
+        }
+        throw error;
+    },
+    handler: async (request, reply)=>{
+        const client = getClientContext(request);
+        if (!client) {
+            throw new ClientError('Authentication required', 'unauthorized', {
+                status: 401
+            });
+        }
+        await changePassword({
+            userId: client.userId,
+            currentPassword: request.body.current_password,
+            newPassword: request.body.new_password,
+            refreshToken: getRefreshTokenCookie(request)
+        });
+        reply.code(204);
+    }
+});
+
+//# sourceMappingURL=change-password.js.map

package/dist/presentation/routes/password/change-password.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/presentation/routes/password/change-password.ts"],"sourcesContent":["import {AUTH_USER} from '@shipfox/api-auth-context';\nimport {changePasswordBodySchema} from '@shipfox/api-auth-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {z} from 'zod';\nimport {changePassword} from '#core/auth.js';\nimport {InvalidCredentialsError, UserNotFoundError} from '#core/errors.js';\nimport {getClientContext} from '#presentation/auth/jwt-auth.js';\nimport {getRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';\n\nexport const changePasswordRoute = defineRoute({\n  method: 'POST',\n  path: '/change-password',\n  description: 'Change the signed-in user password.',\n  auth: AUTH_USER,\n  schema: {\n    body: changePasswordBodySchema,\n    response: {\n      204: z.void(),\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof UserNotFoundError) {\n      throw new ClientError('User not found', 'not-found', {status: 404});\n    }\n    if (error instanceof InvalidCredentialsError) {\n      throw new ClientError('Invalid credentials', 'invalid-credentials', {status: 401});\n    }\n    throw error;\n  },\n  handler: async (request, reply) => {\n    const client = getClientContext(request);\n    if (!client) {\n      throw new ClientError('Authentication required', 'unauthorized', {status: 401});\n    }\n\n    await changePassword({\n      userId: client.userId,\n      currentPassword: request.body.current_password,\n      newPassword: request.body.new_password,\n      refreshToken: getRefreshTokenCookie(request),\n    });\n\n    reply.code(204);\n  },\n});\n"],"names":["AUTH_USER","changePasswordBodySchema","ClientError","defineRoute","z","changePassword","InvalidCredentialsError","UserNotFoundError","getClientContext","getRefreshTokenCookie","changePasswordRoute","method","path","description","auth","schema","body","response","void","errorHandler","error","status","handler","request","reply","client","userId","currentPassword","current_password","newPassword","new_password","refreshToken","code"],"mappings":"AAAA,SAAQA,SAAS,QAAO,4BAA4B;AACpD,SAAQC,wBAAwB,QAAO,wBAAwB;AAC/D,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,cAAc,QAAO,gBAAgB;AAC7C,SAAQC,uBAAuB,EAAEC,iBAAiB,QAAO,kBAAkB;AAC3E,SAAQC,gBAAgB,QAAO,iCAAiC;AAChE,SAAQC,qBAAqB,QAAO,uCAAuC;AAE3E,OAAO,MAAMC,sBAAsBP,YAAY;IAC7CQ,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,MAAMd;IACNe,QAAQ;QACNC,MAAMf;QACNgB,UAAU;YACR,KAAKb,EAAEc,IAAI;QACb;IACF;IACAC,cAAc,CAACC;QACb,IAAIA,iBAAiBb,mBAAmB;YACtC,MAAM,IAAIL,YAAY,kBAAkB,aAAa;gBAACmB,QAAQ;YAAG;QACnE;QACA,IAAID,iBAAiBd,yBAAyB;YAC5C,MAAM,IAAIJ,YAAY,uBAAuB,uBAAuB;gBAACmB,QAAQ;YAAG;QAClF;QACA,MAAMD;IACR;IACAE,SAAS,OAAOC,SAASC;QACvB,MAAMC,SAASjB,iBAAiBe;QAChC,IAAI,CAACE,QAAQ;YACX,MAAM,IAAIvB,YAAY,2BAA2B,gBAAgB;gBAACmB,QAAQ;YAAG;QAC/E;QAEA,MAAMhB,eAAe;YACnBqB,QAAQD,OAAOC,MAAM;YACrBC,iBAAiBJ,QAAQP,IAAI,CAACY,gBAAgB;YAC9CC,aAAaN,QAAQP,IAAI,CAACc,YAAY;YACtCC,cAActB,sBAAsBc;QACtC;QAEAC,MAAMQ,IAAI,CAAC;IACb;AACF,GAAG"}

package/dist/presentation/routes/password/password-reset-confirm.d.ts

@@ -0,0 +1,2 @@
+export declare const passwordResetConfirmRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=password-reset-confirm.d.ts.map

package/dist/presentation/routes/password/password-reset-confirm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-confirm.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/password/password-reset-confirm.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,yBAAyB,iDAwBpC,CAAC"}

package/dist/presentation/routes/password/password-reset-confirm.js

@@ -0,0 +1,36 @@
+import { passwordResetConfirmBodySchema, passwordResetConfirmResponseSchema } from '@shipfox/api-auth-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { confirmPasswordReset } from '#core/auth.js';
+import { TokenInvalidError } from '#core/errors.js';
+import { setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
+import { toAuthSessionDto } from '#presentation/dto/user.js';
+export const passwordResetConfirmRoute = defineRoute({
+    method: 'POST',
+    path: '/password-reset/confirm',
+    description: 'Set a new password using the link sent by email.',
+    schema: {
+        body: passwordResetConfirmBodySchema,
+        response: {
+            200: passwordResetConfirmResponseSchema
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof TokenInvalidError) {
+            throw new ClientError('Reset token is invalid or expired', 'token-invalid', {
+                status: 410
+            });
+        }
+        throw error;
+    },
+    handler: async (request, reply)=>{
+        const { token, new_password } = request.body;
+        const result = await confirmPasswordReset({
+            token,
+            newPassword: new_password
+        });
+        setRefreshTokenCookie(reply, result.refreshToken);
+        return toAuthSessionDto(result);
+    }
+});
+
+//# sourceMappingURL=password-reset-confirm.js.map

package/dist/presentation/routes/password/password-reset-confirm.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/presentation/routes/password/password-reset-confirm.ts"],"sourcesContent":["import {\n  passwordResetConfirmBodySchema,\n  passwordResetConfirmResponseSchema,\n} from '@shipfox/api-auth-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {confirmPasswordReset} from '#core/auth.js';\nimport {TokenInvalidError} from '#core/errors.js';\nimport {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';\nimport {toAuthSessionDto} from '#presentation/dto/user.js';\n\nexport const passwordResetConfirmRoute = defineRoute({\n  method: 'POST',\n  path: '/password-reset/confirm',\n  description: 'Set a new password using the link sent by email.',\n  schema: {\n    body: passwordResetConfirmBodySchema,\n    response: {\n      200: passwordResetConfirmResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof TokenInvalidError) {\n      throw new ClientError('Reset token is invalid or expired', 'token-invalid', {status: 410});\n    }\n    throw error;\n  },\n  handler: async (request, reply) => {\n    const {token, new_password} = request.body;\n\n    const result = await confirmPasswordReset({token, newPassword: new_password});\n    setRefreshTokenCookie(reply, result.refreshToken);\n\n    return toAuthSessionDto(result);\n  },\n});\n"],"names":["passwordResetConfirmBodySchema","passwordResetConfirmResponseSchema","ClientError","defineRoute","confirmPasswordReset","TokenInvalidError","setRefreshTokenCookie","toAuthSessionDto","passwordResetConfirmRoute","method","path","description","schema","body","response","errorHandler","error","status","handler","request","reply","token","new_password","result","newPassword","refreshToken"],"mappings":"AAAA,SACEA,8BAA8B,EAC9BC,kCAAkC,QAC7B,wBAAwB;AAC/B,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,oBAAoB,QAAO,gBAAgB;AACnD,SAAQC,iBAAiB,QAAO,kBAAkB;AAClD,SAAQC,qBAAqB,QAAO,uCAAuC;AAC3E,SAAQC,gBAAgB,QAAO,4BAA4B;AAE3D,OAAO,MAAMC,4BAA4BL,YAAY;IACnDM,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMb;QACNc,UAAU;YACR,KAAKb;QACP;IACF;IACAc,cAAc,CAACC;QACb,IAAIA,iBAAiBX,mBAAmB;YACtC,MAAM,IAAIH,YAAY,qCAAqC,iBAAiB;gBAACe,QAAQ;YAAG;QAC1F;QACA,MAAMD;IACR;IACAE,SAAS,OAAOC,SAASC;QACvB,MAAM,EAACC,KAAK,EAAEC,YAAY,EAAC,GAAGH,QAAQN,IAAI;QAE1C,MAAMU,SAAS,MAAMnB,qBAAqB;YAACiB;YAAOG,aAAaF;QAAY;QAC3EhB,sBAAsBc,OAAOG,OAAOE,YAAY;QAEhD,OAAOlB,iBAAiBgB;IAC1B;AACF,GAAG"}

package/dist/presentation/routes/password/password-reset-request.d.ts

@@ -0,0 +1,2 @@
+export declare const passwordResetRequestRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=password-reset-request.d.ts.map

package/dist/presentation/routes/password/password-reset-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-request.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/password/password-reset-request.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,yBAAyB,iDAkBpC,CAAC"}

package/dist/presentation/routes/password/password-reset-request.js

@@ -0,0 +1,26 @@
+import { passwordResetRequestBodySchema } from '@shipfox/api-auth-dto';
+import { defineRoute } from '@shipfox/node-fastify';
+import { z } from 'zod';
+import { requestPasswordReset } from '#core/auth.js';
+import { createAuthRateLimitPreHandler } from '#presentation/routes/rate-limit.js';
+export const passwordResetRequestRoute = defineRoute({
+    method: 'POST',
+    path: '/password-reset',
+    description: 'Send a password reset email when an account is eligible.',
+    schema: {
+        body: passwordResetRequestBodySchema,
+        response: {
+            204: z.void()
+        }
+    },
+    preHandler: createAuthRateLimitPreHandler('email-send'),
+    handler: async (request, reply)=>{
+        const { email } = request.body;
+        await requestPasswordReset({
+            email
+        });
+        reply.code(204);
+    }
+});
+
+//# sourceMappingURL=password-reset-request.js.map

package/dist/presentation/routes/password/password-reset-request.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/presentation/routes/password/password-reset-request.ts"],"sourcesContent":["import {passwordResetRequestBodySchema} from '@shipfox/api-auth-dto';\nimport {defineRoute} from '@shipfox/node-fastify';\nimport {z} from 'zod';\nimport {requestPasswordReset} from '#core/auth.js';\nimport {createAuthRateLimitPreHandler} from '#presentation/routes/rate-limit.js';\n\nexport const passwordResetRequestRoute = defineRoute({\n  method: 'POST',\n  path: '/password-reset',\n  description: 'Send a password reset email when an account is eligible.',\n  schema: {\n    body: passwordResetRequestBodySchema,\n    response: {\n      204: z.void(),\n    },\n  },\n  preHandler: createAuthRateLimitPreHandler('email-send'),\n  handler: async (request, reply) => {\n    const {email} = request.body;\n\n    await requestPasswordReset({email});\n\n    reply.code(204);\n  },\n});\n"],"names":["passwordResetRequestBodySchema","defineRoute","z","requestPasswordReset","createAuthRateLimitPreHandler","passwordResetRequestRoute","method","path","description","schema","body","response","void","preHandler","handler","request","reply","email","code"],"mappings":"AAAA,SAAQA,8BAA8B,QAAO,wBAAwB;AACrE,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,oBAAoB,QAAO,gBAAgB;AACnD,SAAQC,6BAA6B,QAAO,qCAAqC;AAEjF,OAAO,MAAMC,4BAA4BJ,YAAY;IACnDK,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMV;QACNW,UAAU;YACR,KAAKT,EAAEU,IAAI;QACb;IACF;IACAC,YAAYT,8BAA8B;IAC1CU,SAAS,OAAOC,SAASC;QACvB,MAAM,EAACC,KAAK,EAAC,GAAGF,QAAQL,IAAI;QAE5B,MAAMP,qBAAqB;YAACc;QAAK;QAEjCD,MAAME,IAAI,CAAC;IACb;AACF,GAAG"}

package/dist/presentation/routes/rate-limit.d.ts

@@ -0,0 +1,10 @@
+import { type FastifyReply, type FastifyRequest } from '@shipfox/node-fastify';
+import { type AuthRateLimitAction } from '#core/rate-limit.js';
+interface EmailBody {
+    email: string;
+}
+export declare function createAuthRateLimitPreHandler(action: AuthRateLimitAction): (request: FastifyRequest<{
+    Body: EmailBody;
+}>, reply: FastifyReply) => Promise<void>;
+export {};
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/presentation/routes/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACL,KAAK,mBAAmB,EAMzB,MAAM,qBAAqB,CAAC;AAa7B,UAAU,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AA6ED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,IACzD,SAAS,cAAc,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,CAAC,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F"}

package/dist/presentation/routes/rate-limit.js

@@ -0,0 +1,101 @@
+import { ClientError } from '@shipfox/node-fastify';
+import { AuthRateLimitExceededError, AuthRateLimitUnavailableError, checkAuthRateLimit } from '#core/rate-limit.js';
+const policies = {
+    login: {
+        ip: {
+            limit: 60,
+            windowSeconds: 5 * 60
+        },
+        email: {
+            limit: 10,
+            windowSeconds: 15 * 60
+        }
+    },
+    'email-send': {
+        ip: {
+            limit: 30,
+            windowSeconds: 60 * 60
+        },
+        email: {
+            limit: 3,
+            windowSeconds: 60 * 60
+        }
+    }
+};
+function routeName(request) {
+    return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';
+}
+async function enforceRateLimit(params) {
+    try {
+        await checkAuthRateLimit({
+            action: params.action,
+            scope: params.scope,
+            identifier: params.identifier,
+            ...policies[params.action][params.scope]
+        });
+    } catch (error) {
+        if (error instanceof AuthRateLimitExceededError) {
+            params.request.log.warn({
+                action: error.action,
+                scope: error.scope,
+                route: routeName(params.request),
+                retryAfterSeconds: error.retryAfterSeconds,
+                identifierHmacPrefix: error.identifierHmacPrefix
+            }, 'Auth rate limit blocked request');
+            params.reply.header('Retry-After', String(error.retryAfterSeconds));
+            throw new ClientError('Rate limit exceeded', 'rate-limited', {
+                status: 429,
+                details: {
+                    retry_after_seconds: error.retryAfterSeconds
+                },
+                data: {
+                    action: error.action,
+                    scope: error.scope,
+                    route: routeName(params.request),
+                    identifierHmacPrefix: error.identifierHmacPrefix
+                },
+                cause: error
+            });
+        }
+        if (error instanceof AuthRateLimitUnavailableError) {
+            params.request.log.error({
+                action: error.action,
+                scope: error.scope,
+                route: routeName(params.request),
+                identifierHmacPrefix: error.identifierHmacPrefix,
+                err: error
+            }, 'Auth rate limiter unavailable');
+            throw new ClientError('Authentication rate limiter unavailable', 'auth-rate-limit-unavailable', {
+                status: 503,
+                data: {
+                    action: error.action,
+                    scope: error.scope,
+                    route: routeName(params.request),
+                    identifierHmacPrefix: error.identifierHmacPrefix
+                },
+                cause: error
+            });
+        }
+        throw error;
+    }
+}
+export function createAuthRateLimitPreHandler(action) {
+    return async (request, reply)=>{
+        await enforceRateLimit({
+            request,
+            reply,
+            action,
+            scope: 'ip',
+            identifier: request.ip
+        });
+        await enforceRateLimit({
+            request,
+            reply,
+            action,
+            scope: 'email',
+            identifier: request.body.email
+        });
+    };
+}
+
+//# sourceMappingURL=rate-limit.js.map

package/dist/presentation/routes/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/rate-limit.ts"],"sourcesContent":["import {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';\nimport {\n  type AuthRateLimitAction,\n  AuthRateLimitExceededError,\n  type AuthRateLimitPolicy,\n  type AuthRateLimitScope,\n  AuthRateLimitUnavailableError,\n  checkAuthRateLimit,\n} from '#core/rate-limit.js';\n\nconst policies: Record<AuthRateLimitAction, Record<AuthRateLimitScope, AuthRateLimitPolicy>> = {\n  login: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    email: {limit: 10, windowSeconds: 15 * 60},\n  },\n  'email-send': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n    email: {limit: 3, windowSeconds: 60 * 60},\n  },\n};\n\ninterface EmailBody {\n  email: string;\n}\n\nfunction routeName(request: FastifyRequest): string {\n  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';\n}\n\nasync function enforceRateLimit(params: {\n  request: FastifyRequest;\n  reply: FastifyReply;\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): Promise<void> {\n  try {\n    await checkAuthRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      ...policies[params.action][params.scope],\n    });\n  } catch (error) {\n    if (error instanceof AuthRateLimitExceededError) {\n      params.request.log.warn(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          retryAfterSeconds: error.retryAfterSeconds,\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        'Auth rate limit blocked request',\n      );\n      params.reply.header('Retry-After', String(error.retryAfterSeconds));\n      throw new ClientError('Rate limit exceeded', 'rate-limited', {\n        status: 429,\n        details: {retry_after_seconds: error.retryAfterSeconds},\n        data: {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        cause: error,\n      });\n    }\n\n    if (error instanceof AuthRateLimitUnavailableError) {\n      params.request.log.error(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n          err: error,\n        },\n        'Auth rate limiter unavailable',\n      );\n      throw new ClientError(\n        'Authentication rate limiter unavailable',\n        'auth-rate-limit-unavailable',\n        {\n          status: 503,\n          data: {\n            action: error.action,\n            scope: error.scope,\n            route: routeName(params.request),\n            identifierHmacPrefix: error.identifierHmacPrefix,\n          },\n          cause: error,\n        },\n      );\n    }\n\n    throw error;\n  }\n}\n\nexport function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest<{Body: EmailBody}>, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'email',\n      identifier: request.body.email,\n    });\n  };\n}\n"],"names":["ClientError","AuthRateLimitExceededError","AuthRateLimitUnavailableError","checkAuthRateLimit","policies","login","ip","limit","windowSeconds","email","routeName","request","routeOptions","url","split","enforceRateLimit","params","action","scope","identifier","error","log","warn","route","retryAfterSeconds","identifierHmacPrefix","reply","header","String","status","details","retry_after_seconds","data","cause","err","createAuthRateLimitPreHandler","body"],"mappings":"AAAA,SAAQA,WAAW,QAA+C,wBAAwB;AAC1F,SAEEC,0BAA0B,EAG1BC,6BAA6B,EAC7BC,kBAAkB,QACb,sBAAsB;AAE7B,MAAMC,WAAyF;IAC7FC,OAAO;QACLC,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCC,OAAO;YAACF,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCC,OAAO;YAACF,OAAO;YAAGC,eAAe,KAAK;QAAE;IAC1C;AACF;AAMA,SAASE,UAAUC,OAAuB;IACxC,OAAOA,QAAQC,YAAY,CAACC,GAAG,IAAIF,QAAQE,GAAG,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI;AAClE;AAEA,eAAeC,iBAAiBC,MAM/B;IACC,IAAI;QACF,MAAMb,mBAAmB;YACvBc,QAAQD,OAAOC,MAAM;YACrBC,OAAOF,OAAOE,KAAK;YACnBC,YAAYH,OAAOG,UAAU;YAC7B,GAAGf,QAAQ,CAACY,OAAOC,MAAM,CAAC,CAACD,OAAOE,KAAK,CAAC;QAC1C;IACF,EAAE,OAAOE,OAAO;QACd,IAAIA,iBAAiBnB,4BAA4B;YAC/Ce,OAAOL,OAAO,CAACU,GAAG,CAACC,IAAI,CACrB;gBACEL,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOb,UAAUM,OAAOL,OAAO;gBAC/Ba,mBAAmBJ,MAAMI,iBAAiB;gBAC1CC,sBAAsBL,MAAMK,oBAAoB;YAClD,GACA;YAEFT,OAAOU,KAAK,CAACC,MAAM,CAAC,eAAeC,OAAOR,MAAMI,iBAAiB;YACjE,MAAM,IAAIxB,YAAY,uBAAuB,gBAAgB;gBAC3D6B,QAAQ;gBACRC,SAAS;oBAACC,qBAAqBX,MAAMI,iBAAiB;gBAAA;gBACtDQ,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOb,UAAUM,OAAOL,OAAO;oBAC/Bc,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QACF;QAEA,IAAIA,iBAAiBlB,+BAA+B;YAClDc,OAAOL,OAAO,CAACU,GAAG,CAACD,KAAK,CACtB;gBACEH,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOb,UAAUM,OAAOL,OAAO;gBAC/Bc,sBAAsBL,MAAMK,oBAAoB;gBAChDS,KAAKd;YACP,GACA;YAEF,MAAM,IAAIpB,YACR,2CACA,+BACA;gBACE6B,QAAQ;gBACRG,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOb,UAAUM,OAAOL,OAAO;oBAC/Bc,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QAEJ;QAEA,MAAMA;IACR;AACF;AAEA,OAAO,SAASe,8BAA8BlB,MAA2B;IACvE,OAAO,OAAON,SAA4Ce;QACxD,MAAMX,iBAAiB;YACrBJ;YACAe;YACAT;YACAC,OAAO;YACPC,YAAYR,QAAQL,EAAE;QACxB;QAEA,MAAMS,iBAAiB;YACrBJ;YACAe;YACAT;YACAC,OAAO;YACPC,YAAYR,QAAQyB,IAAI,CAAC3B,KAAK;QAChC;IACF;AACF"}

package/dist/presentation/routes/registration/signup.d.ts

@@ -0,0 +1,2 @@
+export declare const signupRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=signup.d.ts.map

package/dist/presentation/routes/registration/signup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/registration/signup.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,WAAW,iDAmEtB,CAAC"}

package/dist/presentation/routes/registration/signup.js

@@ -0,0 +1,82 @@
+import { signupBodySchema, signupResponseSchema } from '@shipfox/api-auth-dto';
+import { InvitationEmailMismatchError, TokenAlreadyUsedError, TokenExpiredError, TokenInvalidError as WorkspacesTokenInvalidError } from '@shipfox/api-workspaces';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { signup, signupWithInvitation } from '#core/auth.js';
+import { EmailTakenError } from '#core/errors.js';
+import { setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
+import { toUserDto } from '#presentation/dto/user.js';
+export const signupRoute = defineRoute({
+    method: 'POST',
+    path: '/signup',
+    description: 'Create a user account. Sends a verification email unless an invitation token is supplied.',
+    schema: {
+        body: signupBodySchema,
+        response: {
+            201: signupResponseSchema
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof EmailTakenError) {
+            throw new ClientError('Email already registered', 'email-taken', {
+                status: 409
+            });
+        }
+        if (error instanceof WorkspacesTokenInvalidError) {
+            throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {
+                status: 410
+            });
+        }
+        if (error instanceof TokenAlreadyUsedError) {
+            throw new ClientError('Invitation has already been accepted', 'invitation-token-used', {
+                status: 410
+            });
+        }
+        if (error instanceof TokenExpiredError) {
+            throw new ClientError('Invitation has expired', 'invitation-token-expired', {
+                status: 410
+            });
+        }
+        if (error instanceof InvitationEmailMismatchError) {
+            throw new ClientError('Signup email does not match the invitation', 'invitation-email-mismatch', {
+                status: 403
+            });
+        }
+        throw error;
+    },
+    handler: async (request, reply)=>{
+        const { email, password, name, invitation_token } = request.body;
+        if (invitation_token === undefined) {
+            const user = await signup({
+                email,
+                password,
+                name
+            });
+            reply.code(201);
+            return {
+                user: toUserDto(user)
+            };
+        }
+        const result = await signupWithInvitation({
+            email,
+            password,
+            name,
+            invitationToken: invitation_token
+        });
+        setRefreshTokenCookie(reply, result.refreshToken);
+        reply.code(201);
+        return {
+            user: toUserDto(result.user),
+            token: result.token,
+            membership: result.membership ? {
+                id: result.membership.id,
+                user_id: result.membership.userId,
+                workspace_id: result.membership.workspaceId
+            } : null,
+            ...result.acceptError ? {
+                accept_error: result.acceptError
+            } : {}
+        };
+    }
+});
+
+//# sourceMappingURL=signup.js.map

package/dist/presentation/routes/registration/signup.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/presentation/routes/registration/signup.ts"],"sourcesContent":["import {signupBodySchema, signupResponseSchema} from '@shipfox/api-auth-dto';\nimport {\n  InvitationEmailMismatchError,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  TokenInvalidError as WorkspacesTokenInvalidError,\n} from '@shipfox/api-workspaces';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {signup, signupWithInvitation} from '#core/auth.js';\nimport {EmailTakenError} from '#core/errors.js';\nimport {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';\nimport {toUserDto} from '#presentation/dto/user.js';\n\nexport const signupRoute = defineRoute({\n  method: 'POST',\n  path: '/signup',\n  description:\n    'Create a user account. Sends a verification email unless an invitation token is supplied.',\n  schema: {\n    body: signupBodySchema,\n    response: {\n      201: signupResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof EmailTakenError) {\n      throw new ClientError('Email already registered', 'email-taken', {status: 409});\n    }\n    if (error instanceof WorkspacesTokenInvalidError) {\n      throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {\n        status: 410,\n      });\n    }\n    if (error instanceof TokenAlreadyUsedError) {\n      throw new ClientError('Invitation has already been accepted', 'invitation-token-used', {\n        status: 410,\n      });\n    }\n    if (error instanceof TokenExpiredError) {\n      throw new ClientError('Invitation has expired', 'invitation-token-expired', {status: 410});\n    }\n    if (error instanceof InvitationEmailMismatchError) {\n      throw new ClientError(\n        'Signup email does not match the invitation',\n        'invitation-email-mismatch',\n        {status: 403},\n      );\n    }\n    throw error;\n  },\n  handler: async (request, reply) => {\n    const {email, password, name, invitation_token} = request.body;\n\n    if (invitation_token === undefined) {\n      const user = await signup({email, password, name});\n      reply.code(201);\n      return {user: toUserDto(user)};\n    }\n\n    const result = await signupWithInvitation({\n      email,\n      password,\n      name,\n      invitationToken: invitation_token,\n    });\n    setRefreshTokenCookie(reply, result.refreshToken);\n    reply.code(201);\n    return {\n      user: toUserDto(result.user),\n      token: result.token,\n      membership: result.membership\n        ? {\n            id: result.membership.id,\n            user_id: result.membership.userId,\n            workspace_id: result.membership.workspaceId,\n          }\n        : null,\n      ...(result.acceptError ? {accept_error: result.acceptError} : {}),\n    };\n  },\n});\n"],"names":["signupBodySchema","signupResponseSchema","InvitationEmailMismatchError","TokenAlreadyUsedError","TokenExpiredError","TokenInvalidError","WorkspacesTokenInvalidError","ClientError","defineRoute","signup","signupWithInvitation","EmailTakenError","setRefreshTokenCookie","toUserDto","signupRoute","method","path","description","schema","body","response","errorHandler","error","status","handler","request","reply","email","password","name","invitation_token","undefined","user","code","result","invitationToken","refreshToken","token","membership","id","user_id","userId","workspace_id","workspaceId","acceptError","accept_error"],"mappings":"AAAA,SAAQA,gBAAgB,EAAEC,oBAAoB,QAAO,wBAAwB;AAC7E,SACEC,4BAA4B,EAC5BC,qBAAqB,EACrBC,iBAAiB,EACjBC,qBAAqBC,2BAA2B,QAC3C,0BAA0B;AACjC,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,MAAM,EAAEC,oBAAoB,QAAO,gBAAgB;AAC3D,SAAQC,eAAe,QAAO,kBAAkB;AAChD,SAAQC,qBAAqB,QAAO,uCAAuC;AAC3E,SAAQC,SAAS,QAAO,4BAA4B;AAEpD,OAAO,MAAMC,cAAcN,YAAY;IACrCO,QAAQ;IACRC,MAAM;IACNC,aACE;IACFC,QAAQ;QACNC,MAAMnB;QACNoB,UAAU;YACR,KAAKnB;QACP;IACF;IACAoB,cAAc,CAACC;QACb,IAAIA,iBAAiBX,iBAAiB;YACpC,MAAM,IAAIJ,YAAY,4BAA4B,eAAe;gBAACgB,QAAQ;YAAG;QAC/E;QACA,IAAID,iBAAiBhB,6BAA6B;YAChD,MAAM,IAAIC,YAAY,+BAA+B,4BAA4B;gBAC/EgB,QAAQ;YACV;QACF;QACA,IAAID,iBAAiBnB,uBAAuB;YAC1C,MAAM,IAAII,YAAY,wCAAwC,yBAAyB;gBACrFgB,QAAQ;YACV;QACF;QACA,IAAID,iBAAiBlB,mBAAmB;YACtC,MAAM,IAAIG,YAAY,0BAA0B,4BAA4B;gBAACgB,QAAQ;YAAG;QAC1F;QACA,IAAID,iBAAiBpB,8BAA8B;YACjD,MAAM,IAAIK,YACR,8CACA,6BACA;gBAACgB,QAAQ;YAAG;QAEhB;QACA,MAAMD;IACR;IACAE,SAAS,OAAOC,SAASC;QACvB,MAAM,EAACC,KAAK,EAAEC,QAAQ,EAAEC,IAAI,EAAEC,gBAAgB,EAAC,GAAGL,QAAQN,IAAI;QAE9D,IAAIW,qBAAqBC,WAAW;YAClC,MAAMC,OAAO,MAAMvB,OAAO;gBAACkB;gBAAOC;gBAAUC;YAAI;YAChDH,MAAMO,IAAI,CAAC;YACX,OAAO;gBAACD,MAAMnB,UAAUmB;YAAK;QAC/B;QAEA,MAAME,SAAS,MAAMxB,qBAAqB;YACxCiB;YACAC;YACAC;YACAM,iBAAiBL;QACnB;QACAlB,sBAAsBc,OAAOQ,OAAOE,YAAY;QAChDV,MAAMO,IAAI,CAAC;QACX,OAAO;YACLD,MAAMnB,UAAUqB,OAAOF,IAAI;YAC3BK,OAAOH,OAAOG,KAAK;YACnBC,YAAYJ,OAAOI,UAAU,GACzB;gBACEC,IAAIL,OAAOI,UAAU,CAACC,EAAE;gBACxBC,SAASN,OAAOI,UAAU,CAACG,MAAM;gBACjCC,cAAcR,OAAOI,UAAU,CAACK,WAAW;YAC7C,IACA;YACJ,GAAIT,OAAOU,WAAW,GAAG;gBAACC,cAAcX,OAAOU,WAAW;YAAA,IAAI,CAAC,CAAC;QAClE;IACF;AACF,GAAG"}

package/dist/presentation/routes/session/login.d.ts

@@ -0,0 +1,2 @@
+export declare const loginRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=login.d.ts.map

package/dist/presentation/routes/session/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/session/login.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,UAAU,iDAqCrB,CAAC"}

package/dist/presentation/routes/session/login.js

@@ -0,0 +1,48 @@
+import { loginBodySchema, loginResponseSchema } from '@shipfox/api-auth-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { login } from '#core/auth.js';
+import { AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError } from '#core/errors.js';
+import { setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
+import { toAuthSessionDto } from '#presentation/dto/user.js';
+import { createAuthRateLimitPreHandler } from '#presentation/routes/rate-limit.js';
+export const loginRoute = defineRoute({
+    method: 'POST',
+    path: '/login',
+    description: 'Sign in with an email address and password.',
+    schema: {
+        body: loginBodySchema,
+        response: {
+            200: loginResponseSchema
+        }
+    },
+    preHandler: createAuthRateLimitPreHandler('login'),
+    errorHandler: (error)=>{
+        if (error instanceof InvalidCredentialsError) {
+            throw new ClientError('Invalid credentials', 'invalid-credentials', {
+                status: 401
+            });
+        }
+        if (error instanceof EmailNotVerifiedError) {
+            throw new ClientError('Email not verified', 'email-not-verified', {
+                status: 403
+            });
+        }
+        if (error instanceof AuthDependencyUnavailableError) {
+            throw new ClientError('Authentication dependency unavailable', 'auth-dependency-unavailable', {
+                status: 503
+            });
+        }
+        throw error;
+    },
+    handler: async (request, reply)=>{
+        const { email, password } = request.body;
+        const result = await login({
+            email,
+            password
+        });
+        setRefreshTokenCookie(reply, result.refreshToken);
+        return toAuthSessionDto(result);
+    }
+});
+
+//# sourceMappingURL=login.js.map