@shipfox/api-auth 2.0.0

package/package.json

@@ -0,0 +1,88 @@
+{
+  "name": "@shipfox/api-auth",
+  "license": "MIT",
+  "version": "2.0.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
+    "directory": "libs/api/auth"
+  },
+  "private": false,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "imports": {
+    "#test/*": "./test/*",
+    "#*": {
+      "workspace-source": "./src/*",
+      "development": "./src/*",
+      "default": "./dist/*"
+    }
+  },
+  "exports": {
+    ".": {
+      "development": {
+        "types": "./src/index.ts",
+        "default": "./src/index.ts"
+      },
+      "default": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./config": {
+      "development": {
+        "types": "./src/config.ts",
+        "default": "./src/config.ts"
+      },
+      "default": {
+        "types": "./dist/config.d.ts",
+        "default": "./dist/config.js"
+      }
+    }
+  },
+  "dependencies": {
+    "@fastify/cookie": "^11.0.2",
+    "@node-rs/argon2": "^2.0.2",
+    "drizzle-orm": "^0.45.2",
+    "zod": "^4.4.3",
+    "@shipfox/api-auth-context": "2.0.0",
+    "@shipfox/api-auth-dto": "2.0.0",
+    "@shipfox/config": "1.2.1",
+    "@shipfox/api-workspaces-dto": "2.0.0",
+    "@shipfox/node-drizzle": "0.2.1",
+    "@shipfox/node-fastify": "0.2.1",
+    "@shipfox/node-module": "0.2.0",
+    "@shipfox/node-opentelemetry": "0.5.0",
+    "@shipfox/node-outbox": "0.2.1",
+    "@shipfox/node-jwt": "0.2.0",
+    "@shipfox/node-postgres": "0.4.1",
+    "@shipfox/node-rate-limit": "0.2.0",
+    "@shipfox/node-tokens": "0.2.0",
+    "@shipfox/node-mailer": "0.1.2",
+    "@shipfox/api-workspaces": "2.0.0",
+    "@shipfox/node-email": "0.2.1"
+  },
+  "devDependencies": {
+    "@types/pg": "^8.15.5",
+    "drizzle-kit": "^0.31.10",
+    "fastify": "^5.3.3",
+    "fastify-type-provider-zod": "^6.0.0",
+    "fishery": "^2.2.2",
+    "jose": "^6.0.0",
+    "@shipfox/swc": "1.2.5",
+    "@shipfox/biome": "1.8.1",
+    "@shipfox/typescript": "1.1.6",
+    "@shipfox/vitest": "1.2.2",
+    "@shipfox/ts-config": "1.3.8"
+  },
+  "scripts": {
+    "build": "shipfox-swc",
+    "check": "shipfox-biome-check",
+    "check:fix": "shipfox-biome-check --write",
+    "test": "shipfox-vitest-run",
+    "test:watch": "shipfox-vitest-watch",
+    "type": "shipfox-tsc-check",
+    "type:emit": "shipfox-tsc-emit"
+  }
+}

package/src/config.ts

@@ -0,0 +1,88 @@
+import {createConfig, num, str} from '@shipfox/config';
+import {createConsoleMailer, createSmtpMailer, type Mailer} from '@shipfox/node-mailer';
+
+export const config = createConfig({
+  AUTH_JWT_SECRET: str({
+    desc: 'Secret used to sign and verify user access tokens (JWTs). Required, with no default, so startup fails when it is missing.',
+  }),
+  AUTH_JWT_EXPIRES_IN: str({
+    desc: 'How long an access token stays valid. Accepts a duration string such as 15m, 1h, or 7d.',
+    default: '15m',
+  }),
+  AUTH_JOB_LEASE_TOKEN_SECRET: str({
+    desc: 'Secret used to sign and verify job lease tokens. Required, with no default, so startup fails when it is missing.',
+  }),
+  AUTH_JOB_LEASE_TOKEN_EXPIRES_IN: str({
+    desc: 'How long a job lease token stays valid. Set it longer than the longest job (JOB_MAX_DURATION is 60 minutes) plus a safety margin.',
+    default: '90m',
+  }),
+  AUTH_RUNNER_SESSION_TOKEN_SECRET: str({
+    desc: 'Secret used to sign and verify runner session tokens. Required, with no default, so startup fails when it is missing.',
+  }),
+  AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN: str({
+    desc: 'How long a runner session token stays valid. A revoked registration token can leave existing sessions usable until this lifetime ends.',
+    default: '1h',
+  }),
+  AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: num({
+    desc: 'How many days a refresh token stays valid before the user must sign in again.',
+    default: 14,
+  }),
+  AUTH_REFRESH_ROTATION_GRACE_SECONDS: num({
+    desc: 'Window after a refresh token is rotated during which the now-rotated token is still accepted, so concurrent refreshes from parallel tabs do not log the user out. Reuse past this window is treated as a compromise and revokes the session.',
+    default: 30,
+  }),
+  AUTH_REFRESH_COOKIE_NAME: str({
+    desc: 'Name of the browser cookie that stores the refresh token.',
+    default: 'shipfox_refresh_token',
+  }),
+  RATE_LIMIT_IDENTIFIER_SECRET: str({
+    desc: 'Optional secret used to HMAC identifiers before storing rate-limit counters. Leave it unset to derive a stable key from AUTH_JWT_SECRET.',
+    default: undefined,
+  }),
+  CLIENT_BASE_URL: str({
+    desc: 'Base URL of the client app. Used to build links in emails such as password resets.',
+    default: 'http://localhost:5173',
+  }),
+  MAILER_TRANSPORT: str({
+    desc: 'How emails are delivered. Use console to print them to the log, or smtp to send them through an SMTP server.',
+    choices: ['console', 'smtp'],
+    default: 'console',
+  }),
+  MAILER_FROM: str({
+    desc: 'Sender address shown on outgoing emails.',
+    default: 'noreply@shipfox.local',
+  }),
+  SMTP_HOST: str({
+    desc: 'Hostname of the SMTP server. Required when MAILER_TRANSPORT is smtp.',
+    default: undefined,
+  }),
+  SMTP_PORT: num({
+    desc: 'Port of the SMTP server.',
+    default: 587,
+  }),
+  SMTP_USER: str({
+    desc: 'Username for SMTP authentication. Leave it unset if the server needs no login.',
+    default: undefined,
+  }),
+  SMTP_PASSWORD: str({
+    desc: 'Password for SMTP authentication. Leave it unset if the server needs no login.',
+    default: undefined,
+  }),
+});
+
+function createMailer(): Mailer {
+  if (config.MAILER_TRANSPORT === 'smtp') {
+    if (!config.SMTP_HOST) throw new Error('SMTP_HOST is required when MAILER_TRANSPORT=smtp');
+    return createSmtpMailer({
+      host: config.SMTP_HOST,
+      port: config.SMTP_PORT,
+      ...(config.SMTP_USER ? {user: config.SMTP_USER} : {}),
+      ...(config.SMTP_PASSWORD ? {password: config.SMTP_PASSWORD} : {}),
+      from: config.MAILER_FROM,
+    });
+  }
+
+  return createConsoleMailer({from: config.MAILER_FROM});
+}
+
+export const mailer = createMailer();